WO2018192528A1 - Network access method and apparatus, and network device - Google Patents

Network access method and apparatus, and network device Download PDF

Info

Publication number
WO2018192528A1
WO2018192528A1 PCT/CN2018/083565 CN2018083565W WO2018192528A1 WO 2018192528 A1 WO2018192528 A1 WO 2018192528A1 CN 2018083565 W CN2018083565 W CN 2018083565W WO 2018192528 A1 WO2018192528 A1 WO 2018192528A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
user terminal
access
network
identifier
Prior art date
Application number
PCT/CN2018/083565
Other languages
French (fr)
Chinese (zh)
Inventor
于游洋
李华
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP18788148.7A priority Critical patent/EP3582528B1/en
Priority to JP2020504757A priority patent/JP6976411B2/en
Publication of WO2018192528A1 publication Critical patent/WO2018192528A1/en
Priority to US16/566,690 priority patent/US11395143B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/26—Network addressing or numbering for mobility support
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0806—Configuration setting for initial configuration or provisioning, e.g. plug-and-play
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H04L61/5014—Internet protocol [IP] addresses using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H04L61/503—Internet protocol [IP] addresses using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/068—Authentication using credential vaults, e.g. password manager applications or one time password [OTP] applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
    • H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
    • H04L69/322—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions
    • H04L69/325—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the network layer [OSI layer 3], e.g. X.25

Definitions

  • the present application relates to the field of communications technologies, and in particular, to a network access method, apparatus, and network device.
  • the UE Before using the UE for network operations, the UE should be first connected to the network. In the prior art, the UE is used. The network can be accessed through the core network provided by the operator. In order to prevent the illegal UE from accessing the network and ensuring the security of the legitimate UE, the core network is provided with a network access authentication function. When receiving the access information sent by the UE, the UE is usually authenticated by the network to check whether the identity is verified. Legitimate, and after the authentication is passed, assign the network port to the UE to access the network.
  • the core network supports a certain protocol stack, and is provided with a control entity and an authentication and authentication entity.
  • the control entity of the core network follows the corresponding protocol type. Extract the parameters into the information and perform subsequent operations.
  • the fixed network referred to as the fixed network
  • the fixed network core network supports the PPPoE (Point to Point Protocol over Ethernet)/IPoE (Internet Protocol over Ethernet) protocol stack, when the fixed network core network receives
  • the BNG Broadband Network Gateway, Control Device
  • the UE extracts the UE identifier and the authentication parameter from the access information according to the type of the PPPoE/IPoE protocol, and sends the extracted authentication parameter.
  • the device performs authentication by the AAA (Authentication, Authorization and Account authentication and accounting function) device. After the AAA authenticates the authentication parameters, the authentication result is sent to the BNG. If the authentication succeeds, the BNG obtains an IP (Internet Protocol) address from a DHCP (Dynamic Host Configuration Protocol) server. The IP address is sent to the UE in the PPPoE/IPoE protocol type, so that the UE accesses the network using the IP address.
  • AAA Authentication, Authorization and Account authentication and accounting function
  • the UE can also access the mobile network (referred to as mobile) core network.
  • the mobile core network does not support the PPPoE/IPoE protocol stack. Therefore, the fixed network core network and the mobile core network cannot be compatible. If the operator performs full service operation, it is necessary to arrange two networks of the fixed network core network and the mobile core network. Not only does it require a lot of resources, but it is also inconvenient to maintain.
  • the present application provides a network access method, apparatus, and network device to solve the problem that the fixed network core network and the mobile core network are incompatible.
  • the present application provides a network access method, in which, when an access gateway receives a message sent by a user terminal, it may first determine whether the message is a PPPoE message or an IPoE message or a NAS message by determining a type of the message. Or the EAP message, when it is a PPPoE message or an IPoE message, the access information of the user terminal is read from the PPPoE message or the IPoE message, and the access information is encapsulated into a NAS (Non-access stratum) message or An EAP (Extensible Authentication Protocol) message to convert the type of access information, and then send a NAS message or an EAP message to a CP (Control Plane Function).
  • NAS Non-access stratum
  • An EAP Extensible Authentication Protocol
  • the CP configures the network interface information for the user terminal through which the authentication is passed, and sends the network interface information to the access gateway, and the access gateway sends the network interface information to the user terminal, then the user terminal can according to the network interface information. Access to the network.
  • the access gateway can determine the type of the received message and convert the message into a type that can be identified by other network elements of the network device, thereby implementing the user terminal accessing the network. That is, the solution can be compatible with different protocol stack types, so that the user terminal can be accessed to the network without restriction, and then a full-service operation can be performed by arranging a core network, which not only saves resources but also facilitates network maintenance.
  • the access information includes at least one of a session identifier, a user terminal identifier, and a fixed network access point identifier, where the session identifier is an access gateway for the user.
  • the user terminal identifier is a user terminal permanent identifier or a temporary identifier of the user terminal, a physical MAC address of the user terminal, or a network access identifier (NAI) of the user terminal.
  • NAI network access identifier
  • the fixed network access point identifier is at least one of a circuit ID, a physical location identifier, and a logical identifier.
  • the access gateway encapsulates the access information into the NAS message, the access gateway generates the NAS request message, and the access information is carried in the NAS request message. Then, the access gateway sends an initialization user terminal message and carries the NAS request message in the initialization user terminal message.
  • the access gateway encapsulates the access information into a NAS message, including: the access gateway sends an initial user terminal message, and accesses At least one of the fixed network access point identifier and the session identifier in the information is carried in the initial user terminal message; the access gateway generates a NAS request message, and carries the user terminal identifier in the access information in the NAS request message, and The NAS request message is carried in the initialization user terminal message.
  • the NAS request message may be a registration request message or a PDU (Protocol Data Unit) session establishment request message.
  • PDU Protocol Data Unit
  • the access gateway the encapsulating the access information into the EAP message, includes: the access gateway generates an EAP message, and the access information is carried in the EAP message; The access gateway generates a registration request message, and carries the EAP message in the registration request message. Further, the access gateway sends an initialization user terminal message, and the registration request message is carried in the initialization user terminal message.
  • the access gateway can convert the access information into different types of messages according to the specific content of the access information, and can flexibly convert, thereby making the implementation of the solution more flexible and applicable more widely.
  • the CP may first read the access information from the NAS message or the EAP message.
  • the access information includes at least one of the user terminal identifier and the fixed network access point identifier
  • the CP sends at least one of the fixed network access point identifier and the user terminal identifier to the authentication authentication entity to trigger the authentication authentication.
  • the entity performs authentication according to at least one of the fixed network access point identifier and the user terminal identifier, and sends the result of the authentication authentication to the CP after the authentication is completed.
  • the CP may first send the fixed network access point identifier to the authentication and authenticating entity, and receive The authentication and authenticating entity responds to the authentication vector sent by the fixed network access point identifier, and then the CP may generate a challenge value according to the authentication vector, and carry the challenge value in the request for obtaining the user terminal username and password, and send the access to the access.
  • the access gateway After receiving the username and password sent by the user terminal, the access gateway sends the username and password to the CP, and the CP sends the username and password as authentication information to the authentication and authentication entity.
  • the fixed network access point identifier can also be used as the parameter of the authentication authentication, and the implementation manner generates the challenge value by the CP, which is compared with the allocation value of the access gateway in the prior art. It can reduce the data processing capacity of the access gateway and simplify the operation of the access gateway.
  • the SMF Session Management Function
  • the AMF Core Access and Mobility Management Function
  • the message carries at least one of the IP address and the DHCP server address in the NAS reply message to obtain network interface information.
  • the NAS reply message includes a location area identifier, where the location area identifier is set to a null value, a fixed network area identifier, and a special location area identifier.
  • line identification specifically, can be set according to requirements.
  • the CP can configure the appropriate network interface information for the user terminal according to the characteristics of the user terminal, and can also set different protocol message parameters according to the content of the network interface information, so that the function of the CP is more perfect.
  • the user terminal supports the PPPoE/IPoE protocol stack because the message sent by the user terminal is a PPPoE message or an IPoE message, so when the access gateway receives
  • the network interface information sent by the CP is received, at least one of the IP address and the DHCP server address in the network interface information may be read, and then at least one of the IP address or the DHCP server address is passed through the IP configuration message in the PPPoE process.
  • an NCP Network Control Protocol
  • the user terminal or at least one of the IP address or the DHCP server address is sent to the user terminal through an IP configuration message in the DHCP process.
  • the access gateway can not only convert the message sent by the user terminal into a message type that can be identified by other functional network elements of the network device, but also convert the message sent by the other functional network element into the user terminal.
  • the type of message identified enabling network devices to be compatible with different protocol stack types.
  • the PPPoE message may be a PADI (PPPoE Active Discovery Indication) message, and a PPPoE Active Discovery Request (PPPoE Active Discovery Request) message.
  • LCP Link Control Protocol
  • NCP Network Control Protocol
  • the IPoE message can be a DHCP Discover message or a DHCP Request message.
  • the embodiment of the present invention further provides a network access device, where the device includes a module and a unit for performing the method steps of the first aspect and the implementation manner of the first aspect, and specifically, the embodiment of the present invention I will not repeat them here.
  • the embodiment of the present invention further provides a network device, where the network device includes a processor and a communication interface for performing the method steps of the first aspect and the implementation manners of the first aspect, and specifically, the implementation of the present invention The examples are not described here.
  • an embodiment of the present invention further provides a computer program product, comprising instructions for causing a computer to perform the method of the first aspect when the instruction is run on a computer.
  • the embodiment of the present invention further provides a computer storage medium, where the computer storage medium may store a program, and the program may implement some or all of the steps in the embodiments of the network access method provided by the application. .
  • the network access method, device and network device of the present application after receiving the message sent by the user terminal, the access gateway can determine whether the message is The PPPoE or IPoE message, when the message is a PPPoE or IPoE message, the access gateway extracts the access information of the user terminal from the message, and then encapsulates the extracted access information into a NAS or EAP message that the CP can recognize, and Send the NAS or EAP message to the CP.
  • the CP After receiving the NAS or EAP message, the CP triggers the authentication and authentication entity to perform authentication according to the access information, and after the authentication and authentication entity passes the authentication of the user terminal, the CP sends the network to the access gateway.
  • the interface information, and the access gateway sends the network interface information to the user terminal, so that the user terminal accesses the network. It can be seen that when the protocol stack supported by the network device of the solution is incompatible with the protocol stack supported by the user terminal, the access gateway in the network device can identify the message sent by the user terminal, and can convert the information in the message.
  • FIG. 1 is a structural diagram of a network system provided by the present application.
  • FIG. 2 is a schematic diagram of information interaction of a network access method provided by the present application.
  • FIG. 3 is a schematic diagram of information interaction of a first embodiment of a network access method provided by the present application
  • FIG. 4 is a schematic diagram of information interaction of a second implementation manner of a network access method provided by the present application.
  • FIG. 5 is a schematic diagram of information interaction of a third implementation manner of a network access method provided by the present application.
  • FIG. 6 is a schematic structural diagram of a network access apparatus provided by the present application.
  • FIG. 7 is a schematic structural diagram of a network device provided by the present application.
  • FIG. 1 is a structural diagram of a network system provided by the present application.
  • the network system architecture includes a function network element such as an access gateway, a CP, and an AUSF (Authentication Server Function), where the access gateway may be NGPDG (Next Generation Packet Data Gateway) or AGF (Access Gateway Function), which supports user terminals to send messages to the network through the non-3GPP Interworking Function (N3IWF). After receiving the message sent by the user terminal, the message is sent to the CP.
  • NGPDG Next Generation Packet Data Gateway
  • AGF Access Gateway Function
  • the CP includes an AMF and an SMF, wherein the AMF is responsible for the registration process when the user terminal accesses and the location management of the user terminal, and the SMF is responsible for establishing the corresponding session connection when initiating the service to the user terminal.
  • the CP is also responsible for sending authentication information to the AUSF, triggering AUSF authentication, and the AUSF is mainly used for storing user subscription data and user authentication.
  • FIG. 2 is a schematic diagram of information interaction of the network access method provided by the present application.
  • the network access method provided by the present application can be compatible with two protocol stacks, so that the user terminal is not restricted by the protocol stack when accessing the network.
  • the method includes the following content:
  • the method of the present application is applied to a network device, where the network device includes an access gateway and a CP.
  • Step 1 The access gateway receives the PPPoE/IPoE message sent by the user terminal, and obtains the access information of the user terminal corresponding to the PPPoE/IPoE message; in step 2, the access gateway encapsulates the access information into a NAS/EAP message, and The NAS/EAP message is sent to the CP; in step 3, the CP triggers the AUSF to perform authentication based on the access information; in step 4, the CP receives the message that the AUSF sends the authentication pass; and in step 5, the CP configures the network interface for the user terminal.
  • the information is sent to the access gateway.
  • step 6 the access gateway sends the interface data in the network interface information to the user terminal.
  • step 7 the user terminal accesses the network according to the interface data.
  • the message sent by the user terminal to the network device may be a PPPoE message or an IPoE message (for convenience of description, the present application describes the PPPoE message or the IPoE message as a PPPoE/IPoE message), and may also be a NAS message or an EAP message.
  • the present application describes a NAS message or an EAP message as a NAS/EAP message
  • the network device corresponding to the application has different access procedures, and therefore, when accessing the gateway
  • the type of the message may first be determined by reading the type identifier in the header of the message packet to determine whether the message is a PPPoE/IPoE message or a NAS/EAP message. If the message is a NAS/EAP message, the other function network element of the network device can identify the message, and the access gateway can directly send the message to the CP, and the CP performs a subsequent access process.
  • the processing process of each function network element of the network terminal is a process well known to those skilled in the art, which is not detailed herein. If the message sent by the user terminal is a PPPoE/IPoE message, the other function network element of the network device cannot identify the message, and the operation of the user terminal to access the network cannot be continued. Therefore, the access gateway continues to perform step 1 and subsequent steps. Operation to enable the user terminal to access the network.
  • the access information may include at least one of a session identifier, a user terminal identifier, and a fixed network access point identifier.
  • the session identifier is allocated by the access gateway for the user terminal.
  • the access gateway pre-allocates a unique session identifier Session-ID for the user terminal.
  • the user terminal identifier is at least one of a user terminal permanent identifier or a user terminal temporary identifier, a user terminal MAC address or a user terminal NAI, a user terminal user name, and a proxy remote identifier.
  • the fixed network access point identifier is at least one of a line identifier, a physical location identifier, and a logical identifier.
  • the obtaining, by the access gateway, the access information may include: extracting a session identifier of the user terminal included in the PPPoE/IPoE message, and/or a user terminal identifier; and of course, acquiring the session identifier of the user terminal.
  • the method further includes: identifying a source of the PPPoE/IPoE message, and determining a fixed network access point identifier of the user terminal.
  • the content of the access information includes a plurality of different forms, and the access gateway encapsulates the access information into a NAS/EAP message, and may include several implementation manners.
  • the CP triggers the AUSF to perform authentication according to the access information.
  • a variety of different embodiments can be included. The following describes the two implementation processes of encapsulating the NAS/EAP message and the AUSF performing authentication, respectively, corresponding to the access information of different content forms.
  • the access gateway encapsulates the access information into the NAS message, the access gateway generates the NAS request message, and the access information is carried in the NAS request message, and then the access gateway sends the initial user terminal.
  • the message carries the NAS request message in the initialization user terminal message.
  • the access gateway and the CP perform data communication through the N2 interface. Therefore, after the access gateway generates the initial user terminal message, the access gateway also sends the message to the CP through the N2 interface. Therefore, in the description, the present application may The process of generating and transmitting an initial user terminal message by the access gateway is described as that the access gateway sends an initial user terminal message, and the initial user terminal message may be named as an N2 message.
  • the access gateway when the access information includes three types of messages: a session identifier, a user terminal identifier, and a fixed network access point identifier, the access gateway encapsulates the access information into the NAS message, and the access gateway sends the N2 message. Carrying at least one of the fixed network access point identifier and the session identifier in the access information in the N2 message; the access gateway generates a NAS request message, and carries the user terminal identifier in the access information in the NAS request message, and The NAS request message is carried in the N2 message.
  • the NAS request message may be a registration request message or a PDU session establishment request message.
  • the encapsulating the access information into the EAP message by the access gateway includes: the access gateway generates an EAP message, and carries the access information in the EAP message; then, the access gateway generates a registration request message, and the EAP message is sent. Carrying in the registration request message; further, the access gateway sends an N2 message, and the registration request message is carried in the N2 message.
  • the access information is the MAC address of the user
  • the ngPDG may generate the NAI according to the MAC address. Then, the ngPDG carries the NAI in the EAP message, and carries the EAP message in the registration request message. And then the registration request message is carried in the N2 message.
  • the PPPoE message may be a PADI message, a PADR message, an LCP message or an NCP message.
  • the IPoE message can be a DHCP Discover message or a DHCP Request message.
  • the access gateway can determine the protocol type of the message sent by the user terminal according to the message type identifier in the message data packet header, and when the other function network element of the network device does not support the protocol stack of the message, The access gateway is also capable of converting the type of the message, so that the network device can perform the access operation based on the messages of different protocol types, so that the user terminal is not restricted by the protocol stack when accessing the network.
  • the CP may first read the access information from the NAS/EAP message, and when the access information includes the user terminal identifier, and the fixed network connection And transmitting, by the CP, at least one of the fixed network access point identifier and the user terminal identifier to the AUSF, to trigger the AUSF to perform authentication according to at least one of the fixed network access point identifier and the user terminal identifier. And after the authentication is completed, the result of the authentication authentication is sent to the CP.
  • the CP may send the user name of the user terminal to the access gateway.
  • Request for password, challenge, and challenge value The access gateway can obtain its username and password from the user terminal in response to the request, and send the username, password, and the challenge value generated by the access gateway to the CP, and the CP can use the username.
  • the password and challenge value are sent to the AUSF as authentication information.
  • the CP may first send the fixed network access point identifier to the AUSF, and receive The AUSF responds to the authentication vector sent by the fixed network access point identifier. Then, the CP can generate a challenge value according to the authentication vector, and carry the challenge value in the request for obtaining the user terminal username and password, and send the request to the access gateway. After receiving the username and password sent by the user terminal, the gateway sends the username and password to the CP, and the CP sends the username and password as authentication information to the AUSF.
  • the challenge value is generated by the CP
  • the challenge value may be a parameter in the authentication vector.
  • the AUSF generates the authentication in response to the fixed network access point identifier. After the vector, the challenge value can be obtained directly from the authentication vector. Therefore, in this implementation scenario, since the AUSF already knows the challenge value, the CP does not need to carry the challenge value when sending the username and password to the AUSF.
  • the CP should send the challenge value together while sending the username and password to the AUSF.
  • the embodiments of the present invention are not described in detail herein.
  • the CP may directly send the NAI and the fixed network access point identifier as the authentication information to the AUSF.
  • the function of the BNG includes performing information interaction and authentication control with the user terminal, thereby causing incompatibility with the network function architecture of the present application.
  • the access gateway performs the information exchange with the user terminal, and the CP performs the authentication control, so that the functional architecture of the fixed network core network and the functional architecture of the network device of the present application are compatible with each other, thereby improving the function of the network device of the present application. It enables access to user terminals that support different protocol stacks.
  • the SMF in the CP may configure at least one of the IP address and the DHCP server address for the corresponding user terminal, and configure the IP address and
  • the mobile function entity AMF in the CP generates a NAS reply message, and carries at least one of the IP address and the DHCP server address in the NAS reply message to obtain network interface information.
  • the NAS reply message includes the location area identifier
  • the location area identifier is the location area identifier that the CP allocates to the mobile terminal. Because the user terminal is a fixed network terminal in this solution, the CP does not need to allocate the location area identifier. Therefore, in this embodiment, the location area identifier may be set to a null value, or the user terminal may be assigned a fixed network area identifier, a special location area identifier, or a line identifier. Specifically, the location identifier may be set according to requirements. More details.
  • the message sent by the user terminal is a PPPoE/IPoE message
  • the user terminal supports the PPPoE/IPoE protocol stack. Therefore, when the access gateway receives the network interface information sent by the CP, the network interface can be read. At least one of an IP address and a DHCP server address in the information, and then transmitting at least one of the IP address or the DHCP server address to the user terminal through an IP configuration message or an NCP message in the PPPoE process, or At least one of the DHCP server addresses is sent to the user terminal through an IP configuration message in the DHCP process.
  • the access gateway can identify that the user terminal is a fixed network terminal, the access gateway can directly perform authentication on the user terminal, and after the authentication is passed, the authentication is passed.
  • the information is encapsulated into a NAS/EAP message and sent to the CP together with the access information of the user terminal.
  • the CP can directly configure the network interface information for the user terminal and send the information to the access gateway.
  • other execution processes are described in detail above, and are not described herein again.
  • the network access method described in this application can be compatible with different protocol stack types, and can be compatible with the functions of the fixed network core network by dispersing the functions of the fixed network core network function network element, thereby enabling the user terminal.
  • a full-service operation can be performed by arranging a core network, which not only saves resources but also facilitates network maintenance.
  • FIG. 3 is a schematic diagram of information interaction of a first implementation manner of a network access method provided by the present application.
  • the user terminal initiates a PPPoE access procedure
  • the access gateway is an ngPDG.
  • the user terminal sends a PADI message to the ngPDG; in step S22, the ngPDG sends a PPPoE effective discovery providing packet PADO message to the user terminal in response to the request of the user terminal; and in step S23, the user terminal selects the ngPDG.
  • the PPPoE valid discovery request PADR message is sent to the ngPDG; after receiving the PADR message sent by the user terminal, the user terminal is assigned a unique PPPoE session identifier Session-ID; The ngPDG sends a valid discovery session acknowledgement PADS message to the user terminal, the PADS message includes a Session-ID; in step S26, the ngPDG generates a challenge value, and sends the challenge value to the user terminal; in step S27, the user terminal
  • the challenge value and the initial password are MD5 algorithm, and the password challenge-password after HASH is generated.
  • the Session-ID may also be carried in the NAS message.
  • the ngPDG may send a NAS/EAP message corresponding to the Session-ID or the NAI to the CP.
  • the Session-ID or the MAC address is used as the device identifier of the user terminal, and the ngPDG sets the request type as the initial attachment in the NAS message, and sets the PDN type to the IPv4 address and the IPv6 address, or Set the PDN type to only IPv4 or only IPv6 address based on the configuration.
  • step S29 the CP reads and stores the Session-ID and/or the MAC address, and sends an N2 message carrying the EAP-Request message to the ngPDG.
  • the EAP-Request message may include request information for obtaining a user terminal username and a challenge-password.
  • the security level is relatively high because the user name and the challenge-password of the user terminal are relatively high. Therefore, in this embodiment, before the ngPDG sends the username and the challenge-password to the CP, the CP can establish a secure channel with the ngPDG to make the ngPDG. Send the username and challenge-password to the CP through the secure channel.
  • the secure channel can be, but is not limited to, a TTLS secure channel.
  • Step S211 the CP extracts the username, challenge-password, and challenge values from the EAP message, and sends the username, challenge-password, and Challenge values to the AUSF, thereby triggering the AUSF to perform authentication.
  • the AUSF may first search for the subscription data based on the username, and perform a HASH operation on the password corresponding to the username in the subscription data and the received challenge value to obtain an operation result, and then, the operation result and the received challenge-password. For comparison, if the two are the same, the user authentication is passed; otherwise, the user authentication fails.
  • Step S212 after the AUSF performs the authentication authentication, the notification information of the successful authentication is sent to the CP, where the notification information includes the user subscription data.
  • the CP allocates an IP address to the user terminal, and the assigned IP address is carried in the N2 message and sent to the ngPDG.
  • the IP address can be carried in the NAS message.
  • the location area identifier in the NAS message can be set to a null value.
  • the ngPDG sends the notification information of the authentication pass to the user terminal.
  • Step S215 The user terminal initiates an NCP negotiation to the ngPDG, obtains an IP address, and accesses the network according to the IP address.
  • the interaction information between the ngPDG and the user terminal supports the PPPoE protocol stack
  • the interaction information between the ngPDG and the CP supports the NAS/EAP message
  • the ngPDG can identify and bidirectionally convert the PPPoE protocol stack.
  • NAS/EAP protocol stack messages enabling network devices to be compatible with both protocol stacks.
  • FIG. 3 is an optional implementation manner of the solution, and the technical solution of the present application is not limited thereto.
  • FIG. 4 is a schematic diagram of information interaction of a second implementation manner of a network access method provided by the present application.
  • the user terminal initiates a PPPoE access process. Specifically, the following processes are included:
  • Step S31 to step S35 are the process of performing a PPPoE session between the user terminal and the ngPDG.
  • the steps are the same as the step S21 to the step S25.
  • the steps refer to the description of the embodiment shown in FIG. The application will not be repeated here.
  • Step S36 the ngPDG reads the Session-ID or MAC address of the user terminal, identifies the connection source of the PPPOE, and determines the fixed network access point identifier.
  • the fixed network access point identifier is a line identifier.
  • the ngPDG encapsulates the Session-ID or MAC address and the line identifier into a NAS/EAP message, and sends the NAS/EAP message to the CP.
  • step S38 the CP reads and stores the Session-ID or MAC address, and the line identifier, and sends the line identifier to the AUSF.
  • Step S39 The AUSF acquires an authentication vector corresponding to the line according to the line identifier, and sends the authentication vector to the CP.
  • the CP generates a challenge value based on the authentication vector.
  • the CP establishes a secure channel with the ngPDG.
  • the CP sends an EAP-Request message to the ngPDG through the secure channel.
  • the value of the challenge is included in the EAP-Request message.
  • the ngPDG sends the challenge value to the user terminal together with the request for obtaining the username and the challenge-password.
  • step S314 to the step S320 is similar to the process of the step S210 to the step S215 in the embodiment shown in FIG. 3, and details are not described herein again.
  • the challenge value may be a random number in the authentication vector. Therefore, after the AUSF generates the authentication vector in step S39, the random number in the authentication vector may be directly read as the challenge value. Therefore, in this embodiment, the AUSF has already learned the challenge value. Further, the difference between the embodiment and the embodiment shown in FIG. 3 is that when the CP sends the username and the challenge-password to the AUSF, the challenge value is not carried, as shown in FIG. 4 . The description of step S316 in this embodiment is not described herein again.
  • the challenge value is generated by the CP, and therefore, the ngPDG only sends the username and the challenge-password to the CP.
  • the location area identifier in the NAS message can be set to a null value or a line identifier.
  • the ngPDG is used to perform a PPPoE session with the user terminal, and the conversion of the two protocols is also performed. Therefore, the data processing capacity of the ngPDG is large, and the operation is complicated. Based on this, in the present embodiment, the challenge value is generated by the CP, so that the data processing amount of the ngPDG can be reduced, and the operation of the ngPDG can be simplified.
  • FIG. 5 is a schematic diagram of information interaction of a third implementation manner of a network access method provided by the present application.
  • the user terminal initiates an IPoE access procedure. Specifically, in step S41, the user terminal establishes a layer two connection with the ngPDG, and sends a DHCP discovery message to the ngPDG.
  • the fixed network access point identifier may be a line identifier.
  • the ngPDG encapsulates the MAC address and the line identifier into a NAS/EAP message, and sends the NAS/EAP message to the CP.
  • the ngPDG may also send the pre-assigned Session-ID to the CP.
  • the time for obtaining the IP address will be delayed. Therefore, in this embodiment, when the NAS message is generated, the IP address delay acquisition indication is set. .
  • Step S44 the CP extracts and stores the MAC address and the line identifier, and sends the MAC address and the line identifier to the AUSF to trigger the AUSF to perform authentication.
  • the AUSF searches for the user subscription data based on the line identifier, and matches the received MAC address with the MAC address in the subscription data. If the matching succeeds, the authentication authentication passes; otherwise, the authentication authentication fails.
  • step S45 the AUSF sends the user subscription data to the CP.
  • Step S46 The CP allocates a DHCP server address to the user terminal, and sends the address to the ngPDG through a NAS message or an N2 message.
  • the ngPDG sends a DHCP offer message to the user terminal, where the DHCP offer message carries the DHCP server address assigned by the CP.
  • the CP may not allocate a DHCP server address to the user terminal.
  • the CP only sends the notification information of the authentication authentication to the ngPDG, and the ngPDG is the user terminal. Assign a DHCP server address.
  • Step S48 the user terminal accesses the DHCP server address, obtains an IP address from the DHCP server, and accesses the network according to the IP address.
  • the CP when performing step S46, may also allocate an IP address to the user terminal, and send the IP address to the user terminal together with the DHCP server address in the following process, so that the user terminal is configured according to the CP.
  • the assigned IP address is connected to the network, and the user terminal can obtain the IP address by accessing the DHCP server address during the subsequent network operation.
  • the CP may also generate a challenge value, and send the challenge value to the ngPDG through the NAS message, so that the user terminal generates a challenge-password according to the challenge value.
  • the implementation process of step S38 to step S312 in the embodiment shown in FIG. 4 is not detailed in this embodiment.
  • the access gateway may also be replaced with an AGF, and the access information may also be replaced.
  • the application is not described in detail herein.
  • the ngPDG in the network device can identify the message sent by the user terminal, and can send the message.
  • the information in the network device is converted into a message type that can be identified by other network elements in the network device, so that when the user terminal accesses the network, it is not restricted by the protocol stack, and then a full-service operation can be performed by arranging a core network, thereby saving not only Resources, and easy network maintenance.
  • FIG. 6 is a schematic structural diagram of a network access device provided by the present application, where the device is used to perform FIG. 2 to FIG.
  • the method includes an obtaining module 61, a packaging module 62, a sending module 63, and a receiving module 64.
  • the obtaining module 61 is configured to acquire the access information of the user terminal included in the PPPoE message or the IPoE message when receiving the point-to-point connection protocol PPPoE message or the dynamic host configuration protocol IPoE message sent by the user terminal; the encapsulating module 62, For receiving the access information into a non-access stratum NAS message or an extensible authentication protocol EAP message; the sending module 63, configured to send the NAS message or the EAP message to the control plane function entity CP; and the receiving module 64, for receiving The network interface information sent by the CP is sent to the user terminal, so that the user terminal accesses the network.
  • the encapsulating module 62 includes a generating unit and a sending unit, where the generating unit is configured to generate a NAS request message, where the access information is carried in the NAS request message, where the NAS request message is a registration request message or a protocol data unit PDU session establishment request message; a sending unit, configured to send an initialization user terminal message, and carry the NAS request message in the initialization user terminal message.
  • the sending unit is further configured to send an initial user terminal message, and carry at least one of the fixed network access point identifier and the session identifier in the access information in the initialization user terminal message; It is also used to generate a NAS request message, carry the user terminal identifier in the access information in the NAS request message, and carry the NAS request message in the initialized user terminal message.
  • the generating unit is further configured to generate an EAP message, and carry the access information in the EAP message; and generate a registration request message, and carry the EAP message in the registration request message; the sending unit is further configured to send The user terminal message is initialized, and the registration request is carried in the initialization user terminal message.
  • the device further includes a configuration module, wherein, in this embodiment, the sending module 63 is further configured to: when the access information includes at least one of a user terminal identifier and a fixed network access point identifier, connect the fixed network The at least one of the ingress point identifier and the user terminal identifier is sent to the authentication and authenticating entity, and the receiving module 64 is further configured to receive, by the authentication and authenticating entity, the authentication and the authentication according to at least one of the fixed network access point identifier and the user terminal identifier.
  • the configuration module is configured to configure network interface information for the user terminal when the result of the authentication authentication is authentication.
  • the receiving module 64 is specifically configured to: after the sending module 63 sends the access information to the authentication and authenticating entity, receive the authentication vector sent by the authentication and authenticating entity according to the identifier of the fixed network access point; and the sending module 63 is further configured to: Generating a challenge value based on the authentication vector, and sending the challenge value to the access gateway; and sending a request for obtaining the username and password to the user terminal; wherein the request includes a challenge value; the password is that the user terminal performs the challenge value with the initial password.
  • the receiving module 64 is further configured to receive a username and a password; the sending module 63 is further configured to send the username and password to the CP; and send the username and password to the authentication and authenticating entity, so that the authentication and authenticating entity is based on The username and password are authenticated.
  • the configuration module is specifically configured to allocate at least one of an internet protocol address IP address and a host configuration protocol DHCP server address to the user terminal, and generate a NAS reply message, and carry at least one of the IP address and the DHCP server in the NAS reply message. In the middle, get the network interface information.
  • the sending module 63 in another embodiment, specifically for reading at least one of an IP address and a DHCP server address in the network interface information, and passing at least one of the IP address and the DHCP server address through an IP configuration message or network
  • the control protocol NCP message is sent to the user terminal.
  • FIG. 7 is a schematic structural diagram of a network device provided by the present application, where the device is used to perform the network access method shown in FIG. 2 to FIG. 5.
  • the processor 11 and the communication interface 12 are included.
  • the communication interface 12 is configured to receive a PPPoE message or an IPoE message sent by the user terminal, and the processor 11 is configured to obtain the access information of the user terminal included in the PPPoE message or the IPoE message, and encapsulate the access information into a NAS message or an EAP.
  • the communication interface 12 sends the network interface information to the user terminal, so that the user terminal accesses the network.
  • the processor 11 encapsulates the access information into a NAS message, and the processor 11 generates a NAS request message, carries the access information in the NAS request message, generates an initial user terminal message, and carries the NAS request message in the initial user. Or generating an initial user terminal message, carrying at least one of a fixed network access point identifier and a session identifier in the access information in an initial user terminal message; and generating a NAS request message, where the information is to be accessed.
  • the user terminal identifier is carried in the NAS request message, and the NAS request message is carried in the initialization user terminal message.
  • the NAS request message is a registration request message or a protocol data unit PDU session establishment request message.
  • the processor 11 encapsulates the access information into an EAP message, and the processor 11 generates an EAP message, and carries the access information in the EAP message. Then, the registration request message is generated, and the EAP message is carried in the registration request message; The initial user terminal message is generated, and the registration request is carried in the initialization user terminal message.
  • the processor 11 is further configured to: according to the user terminal identifier in the access information, and at least the fixed network access point identifier. One performs authentication and obtains an authentication result.
  • the network interface information is configured for the user terminal.
  • the processor 11 searches for an authentication vector according to the fixed network access point identifier, and generates a challenge value according to the authentication vector; the communication interface 12 sends the challenge value to the user terminal, and receives the user name and password sent by the user terminal; The processor 11 performs authentication based on the username, password, and challenge value, and obtains an authentication result.
  • the processor 11 configures the network interface information for the user terminal to perform at least one of the Internet Protocol address IP address and the host configuration protocol DHCP server address for the user terminal through the SMF; and generates the NAS reply message by using the AMF. And carrying at least one of the IP address and the DHCP server in the NAS reply message to obtain network interface information.
  • the communication interface 12 sends the network interface information to the user terminal, and the specific implementation is: the communication interface sends at least one of the IP address and the DHCP server address to the user terminal by using an IP configuration message or a network control protocol NCP message.
  • embodiments of the invention may be provided as a method, apparatus (device), or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • the present invention has been described with reference to an information interaction diagram of a method, apparatus (device) and computer program product according to an embodiment of the present invention. It should be understood that each process in the information interaction diagram, and a combination of processes in the information interaction diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. A device that implements the functions specified in one or more processes of a flowchart.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the device implements the functions specified in one or more flows of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more flows of the flowchart.
  • the embodiment of the present invention further provides a computer storage medium, where the computer storage medium can store a program, and when the program is executed, the part of the network access method shown in FIG. 1 to FIG. All the steps, specifically, the embodiments of the present invention are not described in detail herein.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

Disclosed in the present application are a network access method and apparatus, and a network device. The network access method comprises: upon receiving a point to point protocol over Ethernet (PPPoE) message or an Internet protocol over Ethernet (IPoE) message, an access gateway acquiring access information comprised in the PPPoE message or IPoE message, encapsulating the access information into a NAS message or EAP message, and sending the NAS message or EAP message to a control plane (CP); the access gateway receiving network interface information sent by the CP; and the access gateway sending the network interface information to a user terminal, such that the user terminal accesses the network. The solution of the present application removes the limitation on access to a network by a user terminal caused by a protocol stack, such that all-service operation can be performed only by arranging one core network, thereby saving resources and facilitating network maintenance.

Description

网络接入方法、装置和网络设备Network access method, device and network device
本申请要求于2017年4月18日提交中国专利局、申请号为201710253160.0、发明名称为“网络接入方法、装置和网络设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。This application claims the priority of the Chinese Patent Application filed on Apr. 18, 2017, filed Jan. In the application.
技术领域Technical field
本申请涉及通信技术领域，尤其涉及一种网络接入方法、装置和网络设备。The present application relates to the field of communications technologies, and in particular, to a network access method, apparatus, and network device.
背景技术Background technique
目前，随着UE(User Equipment，用户设备)功能的完善，人们普遍使用UE进行网络操作，而在使用UE进行网络操作之前，通常，应当先将该UE接入网络，现有技术中，UE可通过运营商提供的核心网接入网络。为了避免非法UE接入网络，同时保证合法UE的安全，核心网设置有网络接入认证功能，在接收到UE发送的接入信息时，通常对UE进行网络接入认证，以审核其身份是否合法，并在认证通过后，为该UE分配网络端口，以使其接入网络。Currently, with the improvement of the functionality of the user equipment (UE), the UE is generally used for network operations. Before using the UE for network operations, the UE should be first connected to the network. In the prior art, the UE is used. The network can be accessed through the core network provided by the operator. In order to prevent the illegal UE from accessing the network and ensuring the security of the legitimate UE, the core network is provided with a network access authentication function. When receiving the access information sent by the UE, the UE is usually authenticated by the network to check whether the identity is verified. Legitimate, and after the authentication is passed, assign the network port to the UE to access the network.
具体的，核心网支持某一种协议栈，且，设置有控制实体和鉴权认证实体，当待认证UE向核心网发送接入信息时，核心网的控制实体按照相应的协议类型，从接入信息中提取参数，并执行后续操作。例如，固定网络(简称固网)核心网支持PPPoE(Point to Point Protocol over Ethernet，点到点连接协议)/IPoE(Internet Protocol over Ethernet，动态主机配置协议)协议栈，当固网核心网接收到UE的接入信息时，其中设置的BNG(Broadband Network Gateway，宽带网络网关控制设备)按照PPPoE/IPoE协议的类型，从接入信息中提取UE标识以及认证参数，并将所提取的认证参数发送到AAA(Authentication，Authorization and Account鉴权授权与计费功能)设备执行鉴权。当AAA对认证参数鉴权完成后，将鉴权结果发送到BNG，如果鉴权成功，BNG从DHCP(Dynamic Host Configuration Protocol，动态主机配置协议)服务器获取IP(Internet Protocol，网络协议)地址，并将IP地址以PPPoE/IPoE协议的类型发送到UE，以使UE使用该IP地址接入网络。Specifically, the core network supports a certain protocol stack, and is provided with a control entity and an authentication and authentication entity. When the UE to be authenticated sends the access information to the core network, the control entity of the core network follows the corresponding protocol type. Extract the parameters into the information and perform subsequent operations. For example, the fixed network (referred to as the fixed network) core network supports the PPPoE (Point to Point Protocol over Ethernet)/IPoE (Internet Protocol over Ethernet) protocol stack, when the fixed network core network receives When the access information of the UE is set, the BNG (Broadband Network Gateway, Control Device) set in the UE extracts the UE identifier and the authentication parameter from the access information according to the type of the PPPoE/IPoE protocol, and sends the extracted authentication parameter. The device performs authentication by the AAA (Authentication, Authorization and Account authentication and accounting function) device. After the AAA authenticates the authentication parameters, the authentication result is sent to the BNG. If the authentication succeeds, the BNG obtains an IP (Internet Protocol) address from a DHCP (Dynamic Host Configuration Protocol) server. The IP address is sent to the UE in the PPPoE/IPoE protocol type, so that the UE accesses the network using the IP address.
当然，除固网核心网之外，现有技术中，UE还可以接入移动网络(简称移动)核心网。然而，移动核心网并不支持PPPoE/IPoE协议栈，因此，固网核心网和移动核心网无法兼容，如果运营商进行全业务运营，则需要布置固网核心网和移动核心网两张网，不仅需要占用大量资源，而且维护不便。Of course, in addition to the fixed network core network, in the prior art, the UE can also access the mobile network (referred to as mobile) core network. However, the mobile core network does not support the PPPoE/IPoE protocol stack. Therefore, the fixed network core network and the mobile core network cannot be compatible. If the operator performs full service operation, it is necessary to arrange two networks of the fixed network core network and the mobile core network. Not only does it require a lot of resources, but it is also inconvenient to maintain.
发明内容Summary of the invention
本申请提供了一种网络接入方法、装置和网络设备，以解决固网核心网和移动核心网无法兼容的问题。The present application provides a network access method, apparatus, and network device to solve the problem that the fixed network core network and the mobile core network are incompatible.
第一方面，本申请提供了一种网络接入方法，其中，当接入网关接收到用户终端发送的消息时，首先可以通过判断消息的类型，确定该消息是PPPoE消息或IPoE消息还是NAS消息或EAP消息，当是PPPoE消息或IPoE消息时，从PPPoE消息或IPoE消息中读取用户终端的接入信息，并将接入信息封装成NAS(Non-access stratum，非接入层)消息或EAP(Extensible Authentication Protocol，可扩展身份验证协议)消息，以转换接入信息的类型，然后，将NAS消息或EAP消息发送给CP(Control plane function，控制面功能实体)。CP对于鉴权通过的用户终端，为其配置网络接口信息，并将网络接口信息发送到接入网关，接入网关再将网络接口信息发送到用户终端，那么，用户终端则可以根据网络接口信息接入网络。In a first aspect, the present application provides a network access method, in which, when an access gateway receives a message sent by a user terminal, it may first determine whether the message is a PPPoE message or an IPoE message or a NAS message by determining a type of the message. Or the EAP message, when it is a PPPoE message or an IPoE message, the access information of the user terminal is read from the PPPoE message or the IPoE message, and the access information is encapsulated into a NAS (Non-access stratum) message or An EAP (Extensible Authentication Protocol) message to convert the type of access information, and then send a NAS message or an EAP message to a CP (Control Plane Function). The CP configures the network interface information for the user terminal through which the authentication is passed, and sends the network interface information to the access gateway, and the access gateway sends the network interface information to the user terminal, then the user terminal can according to the network interface information. Access to the network.
由此可见，采用本实现方式，接入网关能够判断所接收的消息的类型，并将消息转换为网络设备的其他网元能够识别的类型，从而实现用户终端接入网络。即，本方案，能够兼容不同的协议栈类型，从而能够使得用户终端接入网络时，不受限制，进而通过布置一张核心网即可进行全业务运营，不仅节省资源，而且便于网络维护。It can be seen that, in this implementation manner, the access gateway can determine the type of the received message and convert the message into a type that can be identified by other network elements of the network device, thereby implementing the user terminal accessing the network. That is, the solution can be compatible with different protocol stack types, so that the user terminal can be accessed to the network without restriction, and then a full-service operation can be performed by arranging a core network, which not only saves resources but also facilitates network maintenance.
结合第一方面，在第一方面第一种可能的实现方式中，接入信息包括会话标识、用户终端标识和固网接入点标识中的至少一个；其中，会话标识是接入网关为用户终端分配的；用户终端标识是用户终端永久标识或者用户终端临时标识，用户终端物理MAC(Media Access Control，物理地址)地址或者用户终端网络接入标识NAI(Network Access Identifier，网络接入标识)，用户终端用户名，和代理远端标识(Agent Remote ID)中的至少一个；固网接入点标识是线路标识(circuit ID)、物理位置标识和逻辑标识中的至少一个。With reference to the first aspect, in a first possible implementation manner of the first aspect, the access information includes at least one of a session identifier, a user terminal identifier, and a fixed network access point identifier, where the session identifier is an access gateway for the user. The user terminal identifier is a user terminal permanent identifier or a temporary identifier of the user terminal, a physical MAC address of the user terminal, or a network access identifier (NAI) of the user terminal. At least one of a user terminal user name and an agent remote ID; the fixed network access point identifier is at least one of a circuit ID, a physical location identifier, and a logical identifier.
采用本实现方式，能够识别并转换各种形式的接入信息的类型，从而使得本方案适用性更广，功能更加完善。With this implementation, the types of access information of various forms can be identified and converted, thereby making the scheme more applicable and more complete.
结合第一方面，在第一方面第二种可能的实现方式中，接入网关将接入信息封装成NAS消息包括：接入网关生成NAS请求消息，将接入信息携带在NAS请求消息中，然后，接入网关发送初始化用户终端消息，并将NAS请求消息携带在初始化用户终端消息中。With reference to the first aspect, in a second possible implementation manner of the first aspect, the access gateway encapsulates the access information into the NAS message, the access gateway generates the NAS request message, and the access information is carried in the NAS request message. Then, the access gateway sends an initialization user terminal message and carries the NAS request message in the initialization user terminal message.
此外，当接入信息包括会话标识、用户终端标识和固网接入点标识三类消息时，接入网关将接入信息封装成NAS消息包括：接入网关发送初始化用户终端消息，将接入信息中的固网接入点标识和会话标识中的至少一个携带在初始化用户终端消息中；接入网关生成NAS请求消息，将接入信息中的用户终端标识携带在NAS请求消息中，并将NAS请求消息 携带在初始化用户终端消息中。In addition, when the access information includes three types of messages: a session identifier, a user terminal identifier, and a fixed network access point identifier, the access gateway encapsulates the access information into a NAS message, including: the access gateway sends an initial user terminal message, and accesses At least one of the fixed network access point identifier and the session identifier in the information is carried in the initial user terminal message; the access gateway generates a NAS request message, and carries the user terminal identifier in the access information in the NAS request message, and The NAS request message is carried in the initialization user terminal message.
其中，NAS请求消息可以是注册请求消息或者PDU(Protocol Data Unit，协议数据单元)会话建立请求消息。The NAS request message may be a registration request message or a PDU (Protocol Data Unit) session establishment request message.
结合第一方面，在第一方面第三种可能的实现方式中，接入网关将接入信息封装成EAP消息包括：接入网关生成EAP消息，将接入信息携带在EAP消息中；然后，接入网关生成注册请求消息，将EAP消息携带在注册请求消息中；进而，接入网关发送初始化用户终端消息，将注册请求消息携带在初始化用户终端消息中。With reference to the first aspect, in a third possible implementation manner of the first aspect, the access gateway, the encapsulating the access information into the EAP message, includes: the access gateway generates an EAP message, and the access information is carried in the EAP message; The access gateway generates a registration request message, and carries the EAP message in the registration request message. Further, the access gateway sends an initialization user terminal message, and the registration request message is carried in the initialization user terminal message.
由此可见，采用本实现方式，接入网关能够根据接入信息的具体内容，将接入信息转换为不同类型的消息，并且能够灵活转换，从而使得本方案的执行更加灵活，适用性更广。Therefore, according to the implementation manner, the access gateway can convert the access information into different types of messages according to the specific content of the access information, and can flexibly convert, thereby making the implementation of the solution more flexible and applicable more widely. .
结合第一方面，在第一方面第四种可能的实现方式中，CP接收到接入网关发送的NAS消息或EAP消息之后，可以首先从NAS消息或EAP消息中读取其中的接入信息，当接入信息包括用户终端标识，和固网接入点标识中的至少一个时，CP将固网接入点标识和用户终端标识中的至少一个发送到鉴权认证实体，以触发鉴权认证实体根据固网接入点标识和用户终端标识中的至少一个执行鉴权，并在鉴权完成之后，将鉴权认证的结果发送到CP。With reference to the first aspect, in a fourth possible implementation manner of the first aspect, after receiving the NAS message or the EAP message sent by the access gateway, the CP may first read the access information from the NAS message or the EAP message. When the access information includes at least one of the user terminal identifier and the fixed network access point identifier, the CP sends at least one of the fixed network access point identifier and the user terminal identifier to the authentication authentication entity to trigger the authentication authentication. The entity performs authentication according to at least one of the fixed network access point identifier and the user terminal identifier, and sends the result of the authentication authentication to the CP after the authentication is completed.
结合第一方面，在第一方面第五种可能的实现方式中，当接入信息包括固网接入点标识时，CP可以首先将固网接入点标识发送到鉴权认证实体，并接收鉴权认证实体响应固网接入点标识所发送的鉴权向量，然后，CP可以根据鉴权向量生成challenge值，并将challenge值携带在获取用户终端用户名和密码的请求中，发送到接入网关，接入网关接收到用户终端发送的用户名和密码之后，将用户名和密码发送到CP，CP将用户名和密码作为鉴权信息发送到鉴权认证实体。With reference to the first aspect, in a fifth possible implementation manner of the first aspect, when the access information includes the fixed network access point identifier, the CP may first send the fixed network access point identifier to the authentication and authenticating entity, and receive The authentication and authenticating entity responds to the authentication vector sent by the fixed network access point identifier, and then the CP may generate a challenge value according to the authentication vector, and carry the challenge value in the request for obtaining the user terminal username and password, and send the access to the access. After receiving the username and password sent by the user terminal, the access gateway sends the username and password to the CP, and the CP sends the username and password as authentication information to the authentication and authentication entity.
由此可见，采用本实现方式，还能够以固网接入点标识作为鉴权认证的参数，并且，本实现方式由CP生成challenge值，与现有技术中接入网关分配challenge值相比，能够减少接入网关的数据处理量，简化接入网关的操作。It can be seen that, in this implementation manner, the fixed network access point identifier can also be used as the parameter of the authentication authentication, and the implementation manner generates the challenge value by the CP, which is compared with the allocation value of the access gateway in the prior art. It can reduce the data processing capacity of the access gateway and simplify the operation of the access gateway.
结合第一方面，在第一方面第六种可能的实现方式中，当CP接收到鉴权认证实体发送的鉴权通过的消息后，CP中的SMF(Session Management Function，会话管理功能实体)可以为相应的用户终端配置IP地址和DHCP服务器地址中的至少一个，并且，在配置IP地址和/或DHCP服务器地址之后，CP中的AMF(Core Access and Mobility Management Function，移动功能实体)生成NAS回复消息，将IP地址和DHCP服务器地址中的至少一个携带在NAS回复消息中，得到网络接口信息。With reference to the first aspect, in a sixth possible implementation manner of the first aspect, after the CP receives the message that the authentication and authentication entity sends the authentication, the SMF (Session Management Function) in the CP may Configuring at least one of an IP address and a DHCP server address for the corresponding user terminal, and after configuring the IP address and/or the DHCP server address, the AMF (Core Access and Mobility Management Function) in the CP generates a NAS reply. The message carries at least one of the IP address and the DHCP server address in the NAS reply message to obtain network interface information.
结合第一方面，在第一方面第七种可能的实现方式中，需要指出的是，NAS回复消息中包括位置区标识，该位置区标识设置为空值、固网区域标识、特殊位置区标识或线路标识，具体的，可以根据需求设置。With reference to the first aspect, in the seventh possible implementation manner of the first aspect, it is pointed out that the NAS reply message includes a location area identifier, where the location area identifier is set to a null value, a fixed network area identifier, and a special location area identifier. Or line identification, specifically, can be set according to requirements.
采用本实现方式，CP能够根据用户终端的特点，为用户终端配置相适应的网络接口信息，并且，还能够根据网络接口信息的内容不同，设置不同的协议消息参数，使得CP的功能更加完善。With the implementation of the present invention, the CP can configure the appropriate network interface information for the user terminal according to the characteristics of the user terminal, and can also set different protocol message parameters according to the content of the network interface information, so that the function of the CP is more perfect.
结合第一方面，在第一方面第八种可能的实现方式中，由于用户终端所发送的消息是PPPoE消息或IPoE消息，因此，用户终端支持PPPoE/IPoE协议栈，所以，当接入网关接收到CP发送的网络接口信息时，可以读取网络接口信息中的IP地址和DHCP服务器地址中的至少一个，然后，将IP地址或者和DHCP服务器地址中的至少一个通过PPPoE流程中的IP配置消息或者NCP(Network Control protocols，网络控制协议)消息发送给用户终端，或者，将IP地址或者和DHCP服务器地址中的至少一个通过DHCP流程中的IP配置消息发送给用户终端。With reference to the first aspect, in the eighth possible implementation manner of the first aspect, the user terminal supports the PPPoE/IPoE protocol stack because the message sent by the user terminal is a PPPoE message or an IPoE message, so when the access gateway receives When the network interface information sent by the CP is received, at least one of the IP address and the DHCP server address in the network interface information may be read, and then at least one of the IP address or the DHCP server address is passed through the IP configuration message in the PPPoE process. Or an NCP (Network Control Protocol) message is sent to the user terminal, or at least one of the IP address or the DHCP server address is sent to the user terminal through an IP configuration message in the DHCP process.
由此可见，本方案中，接入网关不仅能够将用户终端发送的消息，转换为网络设备的其他功能网元能够识别的消息类型，还能够将其他功能网元发送的消息转换为用户终端能够识别的消息类型，从而使得网络设备能够兼容不同的协议栈类型。Therefore, in the solution, the access gateway can not only convert the message sent by the user terminal into a message type that can be identified by other functional network elements of the network device, but also convert the message sent by the other functional network element into the user terminal. The type of message identified, enabling network devices to be compatible with different protocol stack types.
结合第一方面，在第一方面第九种可能的实现方式中，PPPoE消息可以是PADI(PPPoE Active Discovery Indication，PPPOE主动发现指示)消息，PADR(PPPoE Active Discovery request，PPPOE主动发现请求)消息，LCP(Link control protocol，链路控制协议)消息或者NCP消息。IPoE消息可以是DHCP发现消息或DHCP请求消息。With reference to the first aspect, in a ninth possible implementation manner of the first aspect, the PPPoE message may be a PADI (PPPoE Active Discovery Indication) message, and a PPPoE Active Discovery Request (PPPoE Active Discovery Request) message. LCP (Link Control Protocol) message or NCP message. The IPoE message can be a DHCP Discover message or a DHCP Request message.
第二方面，本发明实施例还提供了一种网络接入装置，该装置包括用于执行第一方面及第一方面各实现方式的中方法步骤的模块和单元，具体的，本发明实施例此处不再赘述。In a second aspect, the embodiment of the present invention further provides a network access device, where the device includes a module and a unit for performing the method steps of the first aspect and the implementation manner of the first aspect, and specifically, the embodiment of the present invention I will not repeat them here.
第三方面，本发明实施例还提供了一种网络设备，该网络设备包括用于执行第一方面及第一方面各实现方式的中方法步骤的处理器和通信接口，具体的，本发明实施例此处不再赘述。In a third aspect, the embodiment of the present invention further provides a network device, where the network device includes a processor and a communication interface for performing the method steps of the first aspect and the implementation manners of the first aspect, and specifically, the implementation of the present invention The examples are not described here.
第四方面，本发明实施例还提供了一种计算机程序产品，包括指令，当指令在计算机上运行时，使得计算机执行第一方面的方法。In a fourth aspect, an embodiment of the present invention further provides a computer program product, comprising instructions for causing a computer to perform the method of the first aspect when the instruction is run on a computer.
第五方面，本发明实施例还提供了一种计算机存储介质，该计算机存储介质可存储有程序，该程序执行时可实现包括本申请提供的网络接入方法各实施例中的部分或全部步骤。In a fifth aspect, the embodiment of the present invention further provides a computer storage medium, where the computer storage medium may store a program, and the program may implement some or all of the steps in the embodiments of the network access method provided by the application. .
为解决现有技术中固网核心网和移动核心网无法兼容的问题，本申请的网络接入方法、装置和网络设备，接入网关接收到用户终端发送的消息后，可以判断该消息是否是PPPoE或者IPoE消息，当该消息是PPPoE或者IPoE消息时，接入网关从消息中提取用户终端的接入信息，然后，将所提取的接入信息封装成CP能够识别的NAS或者EAP消息，并将该NAS或者EAP消息发送给CP。而CP在接收到该NAS或者EAP消息之后，根据其中的接入信息触发鉴权认证实体执行鉴权，并在鉴权认证实体对该用户终端鉴权认证通过后，CP向 接入网关发送网络接口信息，进而，接入网关将该网络接口信息发送到用户终端，使得用户终端接入网络。由此可见，本方案的网络设备所支持的协议栈与用户终端所支持的协议栈不兼容时，网络设备中的接入网关能够识别用户终端所发送的消息，并能够将消息中的信息转换为网络设备中其他网元能够识别的消息类型，从而能够使得用户终端接入网络时，不受协议栈的限制，进而通过布置一张核心网即可进行全业务运营，不仅节省资源，而且便于网络维护。In order to solve the problem that the fixed network core network and the mobile core network are incompatible in the prior art, the network access method, device and network device of the present application, after receiving the message sent by the user terminal, the access gateway can determine whether the message is The PPPoE or IPoE message, when the message is a PPPoE or IPoE message, the access gateway extracts the access information of the user terminal from the message, and then encapsulates the extracted access information into a NAS or EAP message that the CP can recognize, and Send the NAS or EAP message to the CP. After receiving the NAS or EAP message, the CP triggers the authentication and authentication entity to perform authentication according to the access information, and after the authentication and authentication entity passes the authentication of the user terminal, the CP sends the network to the access gateway. The interface information, and the access gateway sends the network interface information to the user terminal, so that the user terminal accesses the network. It can be seen that when the protocol stack supported by the network device of the solution is incompatible with the protocol stack supported by the user terminal, the access gateway in the network device can identify the message sent by the user terminal, and can convert the information in the message. It is a type of message that can be identified by other network elements in the network device, so that when the user terminal accesses the network, it is not restricted by the protocol stack, and then a full-service operation can be performed by arranging a core network, which not only saves resources but also facilitates Network Maintenance.
附图说明DRAWINGS
为了更清楚地说明本申请的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，对于本领域普通技术人员而言，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。In order to more clearly illustrate the technical solutions of the present application, the drawings used in the embodiments will be briefly described below. Obviously, for those skilled in the art, without any creative labor, Other drawings can also be obtained from these figures.
图1为本申请提供的网络***架构图；FIG. 1 is a structural diagram of a network system provided by the present application;
图2为本申请提供的网络接入方法的信息交互示意图；2 is a schematic diagram of information interaction of a network access method provided by the present application;
图3为本申请提供的网络接入方法的第一种实施方式的信息交互示意图；FIG. 3 is a schematic diagram of information interaction of a first embodiment of a network access method provided by the present application;
图4为本申请提供的网络接入方法的第二种实施方式的信息交互示意图；4 is a schematic diagram of information interaction of a second implementation manner of a network access method provided by the present application;
图5为本申请提供的网络接入方法的第三种实施方式的信息交互示意图；FIG. 5 is a schematic diagram of information interaction of a third implementation manner of a network access method provided by the present application;
图6为本申请提供的网络接入装置的结构示意图；FIG. 6 is a schematic structural diagram of a network access apparatus provided by the present application;
图7为本申请提供的网络设备的结构示意图。FIG. 7 is a schematic structural diagram of a network device provided by the present application.
具体实施方式detailed description
下面结合附图，对本申请进行描述。The present application is described below in conjunction with the accompanying drawings.
其中，需要指出的是，由于移动核心网与固网核心网所支持的协议栈不同，而基于不同协议栈的特点，移动核心网与固网核心网的功能网元，以及对功能网元的布置也不相同，因此，移动核心网与固网核心网的功能架构不相同，从而进一步导致二者无法兼容。有鉴于此，为了解决该问题，提出了本申请的技术方案。Among them, it should be pointed out that, due to the different protocol stacks supported by the mobile core network and the fixed network core network, and based on the characteristics of different protocol stacks, the functional network elements of the mobile core network and the fixed network core network, and the functional network elements The layout is also different. Therefore, the functional architecture of the mobile core network and the fixed network core network are different, which further leads to incompatibility between the two. In view of this, in order to solve this problem, the technical solution of the present application has been proposed.
参见图1，图1为本申请提供的网络***架构图，该网络***架构包括接入网关，CP和AUSF(Authentication Server Function，鉴权认证实体)等功能网元，其中，接入网关可以是ngPDG(Next Generation packet data gateway，下一代接入网关)或者AGF(Access Gateway Function，接入网关)，支持用户终端通过non-3GPP转换功能(N3IWF：non-3GPP  Interworking Function)向网络发送消息，并在接收到用户终端所发送的消息之后，将消息发送到CP。CP包括AMF和SMF，其中，AMF负责用户终端接入时的注册流程及用户终端的位置管理，SMF负责向用户终端发起业务时，相应会话连接的建立。此外，CP还负责向AUSF发送鉴权信息，触发AUSF鉴权，而AUSF主要用于存储用户签约数据和用户鉴权等。Referring to FIG. 1 , FIG. 1 is a structural diagram of a network system provided by the present application. The network system architecture includes a function network element such as an access gateway, a CP, and an AUSF (Authentication Server Function), where the access gateway may be NGPDG (Next Generation Packet Data Gateway) or AGF (Access Gateway Function), which supports user terminals to send messages to the network through the non-3GPP Interworking Function (N3IWF). After receiving the message sent by the user terminal, the message is sent to the CP. The CP includes an AMF and an SMF, wherein the AMF is responsible for the registration process when the user terminal accesses and the location management of the user terminal, and the SMF is responsible for establishing the corresponding session connection when initiating the service to the user terminal. In addition, the CP is also responsible for sending authentication information to the AUSF, triggering AUSF authentication, and the AUSF is mainly used for storing user subscription data and user authentication.
参见图2，基于上述的网络***架构和功能网元,图2为本申请提供的网络接入方法的信息交互示意图。本申请提供的网络接入方法，能够兼容两种协议栈，使得用户终端接入网络时不受协议栈的限制。具体的，所述方法包括以下内容：Referring to FIG. 2, based on the foregoing network system architecture and functional network elements, FIG. 2 is a schematic diagram of information interaction of the network access method provided by the present application. The network access method provided by the present application can be compatible with two protocol stacks, so that the user terminal is not restricted by the protocol stack when accessing the network. Specifically, the method includes the following content:
其中，本申请的方法应用于网络设备，该网络设备包括接入网关和CP。步骤1，接入网关接收用户终端发送的PPPoE/IPoE消息，并获取PPPoE/IPoE消息对应的用户终端的接入信息；步骤2，接入网关将接入信息封装成NAS/EAP消息，并将NAS/EAP消息发送到所述CP；步骤3，CP基于接入信息触发AUSF执行鉴权；步骤4，CP接收AUSF发送的鉴权通过的消息；步骤5，CP为所述用户终端配置网络接口信息，并将网络接口信息发送到接入网关；步骤6，接入网关将网络接口信息中的接口数据发送给用户终端；步骤7，用户终端根据接口数据接入网络。The method of the present application is applied to a network device, where the network device includes an access gateway and a CP. Step 1: The access gateway receives the PPPoE/IPoE message sent by the user terminal, and obtains the access information of the user terminal corresponding to the PPPoE/IPoE message; in step 2, the access gateway encapsulates the access information into a NAS/EAP message, and The NAS/EAP message is sent to the CP; in step 3, the CP triggers the AUSF to perform authentication based on the access information; in step 4, the CP receives the message that the AUSF sends the authentication pass; and in step 5, the CP configures the network interface for the user terminal. The information is sent to the access gateway. In step 6, the access gateway sends the interface data in the network interface information to the user terminal. In step 7, the user terminal accesses the network according to the interface data.
具体的，由于用户终端向网络设备发送的消息，可能是PPPoE消息或者IPoE消息(为了便于描述，本申请文件将PPPoE消息或者IPoE消息描述为PPPoE/IPoE消息)，也可能是NAS消息或者EAP消息(为了便于描述，本申请文件将NAS消息或者EAP消息描述为NAS/EAP消息)，而对应不同协议类型的消息，本申请所述的网络设备对应的接入过程不同，因此，当接入网关接收到该消息时，首先可以通过读取消息数据包头中的类型标识判断消息的类型，以确定该消息是PPPoE/IPoE消息还是NAS/EAP消息。如果该消息是NAS/EAP消息，那么，网络设备的其他功能网元均能识别该消息，接入网关可以直接将该消息发送给CP，并且，CP执行后续的接入过程。具体的，当用户终端发送的消息是NAS/EAP消息时，网络终端各个功能网元的处理过程为本领域技术人员所熟知的过程，本申请此处不再详述。如果用户终端发送的消息是PPPoE/IPoE消息时，网络设备的其他功能网元无法识别该消息，从而导致用户终端接入网络的操作无法继续执行，因此，接入网关继续执行上述步骤1及后续操作，以使用户终端能够接入网络。Specifically, the message sent by the user terminal to the network device may be a PPPoE message or an IPoE message (for convenience of description, the present application describes the PPPoE message or the IPoE message as a PPPoE/IPoE message), and may also be a NAS message or an EAP message. (For the convenience of description, the present application describes a NAS message or an EAP message as a NAS/EAP message), and corresponding to a message of a different protocol type, the network device corresponding to the application has different access procedures, and therefore, when accessing the gateway Upon receiving the message, the type of the message may first be determined by reading the type identifier in the header of the message packet to determine whether the message is a PPPoE/IPoE message or a NAS/EAP message. If the message is a NAS/EAP message, the other function network element of the network device can identify the message, and the access gateway can directly send the message to the CP, and the CP performs a subsequent access process. Specifically, when the message sent by the user terminal is a NAS/EAP message, the processing process of each function network element of the network terminal is a process well known to those skilled in the art, which is not detailed herein. If the message sent by the user terminal is a PPPoE/IPoE message, the other function network element of the network device cannot identify the message, and the operation of the user terminal to access the network cannot be continued. Therefore, the access gateway continues to perform step 1 and subsequent steps. Operation to enable the user terminal to access the network.
需要指出的是，本实施例中，接入信息可以包括会话标识、用户终端标识和固网接入点标识中的至少一个。其中，会话标识是接入网关为用户终端分配的，例如，在本申请的一个可选示例中，接入网关为用户终端预先分配的唯一会话标识Session-ID。用户终端标识是用户终端永久标识或者用户终端临时标识，用户终端MAC地址或者用户终端NAI，用户终端用户名，和代理远端标识中的至少一个。固网接入点标识是线路标识、物理位置标识和逻辑标识中的至少一个。基于此，本实施例中，接入网关获取接入信息具体可以包括，提取PPPoE/IPoE消息中包含的用户终端的会话标识，和/或，用户终端标识；当然，在获取用户终端的会话标识，和/或，用户终端标识基础上，还可以包括，识别PPPoE/IPoE消 息的来源，并确定用户终端的固网接入点标识。It should be noted that, in this embodiment, the access information may include at least one of a session identifier, a user terminal identifier, and a fixed network access point identifier. The session identifier is allocated by the access gateway for the user terminal. For example, in an optional example of the present application, the access gateway pre-allocates a unique session identifier Session-ID for the user terminal. The user terminal identifier is at least one of a user terminal permanent identifier or a user terminal temporary identifier, a user terminal MAC address or a user terminal NAI, a user terminal user name, and a proxy remote identifier. The fixed network access point identifier is at least one of a line identifier, a physical location identifier, and a logical identifier. Based on this, in the embodiment, the obtaining, by the access gateway, the access information may include: extracting a session identifier of the user terminal included in the PPPoE/IPoE message, and/or a user terminal identifier; and of course, acquiring the session identifier of the user terminal. And/or, based on the user terminal identifier, the method further includes: identifying a source of the PPPoE/IPoE message, and determining a fixed network access point identifier of the user terminal.
基于接入信息的内容包括多种不同形式，接入网关将接入信息封装成NAS/EAP消息的过程，可以包括几种实施方式，此外，CP根据接入信息触发AUSF执行鉴权的过程也可以包括多种不同的实施方式。下面对应不同内容形式的接入信息，分别对封装得到NAS/EAP消息和AUSF执行鉴权两个执行过程进行描述。The content of the access information includes a plurality of different forms, and the access gateway encapsulates the access information into a NAS/EAP message, and may include several implementation manners. In addition, the CP triggers the AUSF to perform authentication according to the access information. A variety of different embodiments can be included. The following describes the two implementation processes of encapsulating the NAS/EAP message and the AUSF performing authentication, respectively, corresponding to the access information of different content forms.
具体的，在一个实施例中，接入网关将接入信息封装成NAS消息包括：接入网关生成NAS请求消息，将接入信息携带在NAS请求消息中，然后，接入网关发送初始化用户终端消息，将NAS请求消息携带在初始化用户终端消息中。Specifically, in an embodiment, the access gateway encapsulates the access information into the NAS message, the access gateway generates the NAS request message, and the access information is carried in the NAS request message, and then the access gateway sends the initial user terminal. The message carries the NAS request message in the initialization user terminal message.
需要说明的是，本方案中，接入网关与CP通过N2接口进行数据通信，因此，接入网关生成初始化用户终端消息后，同样通过N2接口发送给CP，所以，本申请在描述时，可以将接入网关生成、发送初始化用户终端消息的过程描述为，接入网关发送初始化用户终端消息，并可以将初始化用户终端消息命名为N2消息。It should be noted that, in this solution, the access gateway and the CP perform data communication through the N2 interface. Therefore, after the access gateway generates the initial user terminal message, the access gateway also sends the message to the CP through the N2 interface. Therefore, in the description, the present application may The process of generating and transmitting an initial user terminal message by the access gateway is described as that the access gateway sends an initial user terminal message, and the initial user terminal message may be named as an N2 message.
在另一个实施例中，当接入信息包括会话标识、用户终端标识和固网接入点标识三类消息时，接入网关将接入信息封装成NAS消息包括：接入网关发送N2消息，将接入信息中的固网接入点标识和会话标识中的至少一个携带在N2消息中；接入网关生成NAS请求消息，将接入信息中的用户终端标识携带在NAS请求消息中，并将NAS请求消息携带在N2消息中。In another embodiment, when the access information includes three types of messages: a session identifier, a user terminal identifier, and a fixed network access point identifier, the access gateway encapsulates the access information into the NAS message, and the access gateway sends the N2 message. Carrying at least one of the fixed network access point identifier and the session identifier in the access information in the N2 message; the access gateway generates a NAS request message, and carries the user terminal identifier in the access information in the NAS request message, and The NAS request message is carried in the N2 message.
其中，NAS请求消息可以是注册请求消息或者PDU会话建立请求消息。The NAS request message may be a registration request message or a PDU session establishment request message.
在另一个实施例中，接入网关将接入信息封装成EAP消息包括：接入网关生成EAP消息，将接入信息携带在EAP消息中；然后，接入网关生成注册请求消息，将EAP消息携带在注册请求消息中；进而，接入网关发送N2消息，将注册请求消息携带在N2消息中。In another embodiment, the encapsulating the access information into the EAP message by the access gateway includes: the access gateway generates an EAP message, and carries the access information in the EAP message; then, the access gateway generates a registration request message, and the EAP message is sent. Carrying in the registration request message; further, the access gateway sends an N2 message, and the registration request message is carried in the N2 message.
例如，在本方案的一个可选示例中，接入信息是用户的MAC地址，ngPDG可以根据MAC地址生成NAI，然后，ngPDG将NAI携带在EAP消息中，并将EAP消息携带在注册请求消息中，进而将注册请求消息携带在N2消息中。For example, in an optional example of the solution, the access information is the MAC address of the user, and the ngPDG may generate the NAI according to the MAC address. Then, the ngPDG carries the NAI in the EAP message, and carries the EAP message in the registration request message. And then the registration request message is carried in the N2 message.
此外，需要指出的是，本方案中，PPPoE消息可以是PADI消息，PADR消息，LCP消息或者NCP消息。IPoE消息可以是DHCP发现消息或DHCP请求消息。而本方案上述的执行过程，对于各种形式的PPPoE消息或者IPoE消息均适用，具体的，可以参见上述描述，本方案将不再针对每种具体形式的消息一一详述。In addition, it should be noted that in this solution, the PPPoE message may be a PADI message, a PADR message, an LCP message or an NCP message. The IPoE message can be a DHCP Discover message or a DHCP Request message. The above-mentioned implementation process of the present solution is applicable to various forms of PPPoE messages or IPoE messages. For details, refer to the foregoing description, and the solution will not be detailed for each specific form of the message.
由此可见，本申请的技术方案，接入网关能够根据消息数据包头中的消息类型标识确定用户终端发送的消息的协议类型，并且，当网络设备的其他功能网元不支持该消息的协议栈时，接入网关还能够转换消息的类型，从而使得网络设备能够基于不同协议类型的消息，执行接入操作，进而使得用户终端在接入网络时，不受协议栈的限制。It can be seen that, in the technical solution of the present application, the access gateway can determine the protocol type of the message sent by the user terminal according to the message type identifier in the message data packet header, and when the other function network element of the network device does not support the protocol stack of the message, The access gateway is also capable of converting the type of the message, so that the network device can perform the access operation based on the messages of different protocol types, so that the user terminal is not restricted by the protocol stack when accessing the network.
在上述描述的基础上，CP接收到接入网关发送的NAS/EAP消息之后，可以首先从NAS/EAP消息中读取其中的接入信息，当接入信息包括用户终端标识，和固网接入点标识中的至少一个时，CP将固网接入点标识和用户终端标识中的至少一个发送到AUSF，以触发AUSF根据固网接入点标识和用户终端标识中的至少一个执行鉴权，并在鉴权完成之后，将鉴权认证的结果发送到CP。On the basis of the above description, after receiving the NAS/EAP message sent by the access gateway, the CP may first read the access information from the NAS/EAP message, and when the access information includes the user terminal identifier, and the fixed network connection And transmitting, by the CP, at least one of the fixed network access point identifier and the user terminal identifier to the AUSF, to trigger the AUSF to perform authentication according to at least one of the fixed network access point identifier and the user terminal identifier. And after the authentication is completed, the result of the authentication authentication is sent to the CP.
具体的，在本申请的一个可选实施例中，当接入信息的内容仅是用户终端标识，例如，Session-ID和/或NAI时，CP可以向接入网关发送获取用户终端的用户名、密码和challenge值的请求，接入网关可以响应该请求从用户终端获取其用户名和密码，并将用户名、密码和接入网关预先生成的challenge值发送到CP，而CP则可以将用户名、密码和challenge值作为鉴权信息发送到AUSF。Specifically, in an optional embodiment of the present application, when the content of the access information is only the user terminal identifier, for example, the Session-ID and/or the NAI, the CP may send the user name of the user terminal to the access gateway. Request for password, challenge, and challenge value. The access gateway can obtain its username and password from the user terminal in response to the request, and send the username, password, and the challenge value generated by the access gateway to the CP, and the CP can use the username. The password and challenge value are sent to the AUSF as authentication information.
在另一种可选实施方式中，当接入信息的内容是Session-ID和/或NAI，以及固网接入点标识时，CP可以首先将固网接入点标识发送到AUSF，并接收AUSF响应固网接入点标识所发送的鉴权向量，然后，CP可以根据鉴权向量生成challenge值，并将challenge值携带在获取用户终端用户名和密码的请求中，发送到接入网关，接入网关接收到用户终端发送的用户名和密码之后，将用户名和密码发送到CP，CP将用户名和密码作为鉴权信息发送到AUSF。In another optional implementation manner, when the content of the access information is a Session-ID and/or a NAI, and the fixed network access point identifier, the CP may first send the fixed network access point identifier to the AUSF, and receive The AUSF responds to the authentication vector sent by the fixed network access point identifier. Then, the CP can generate a challenge value according to the authentication vector, and carry the challenge value in the request for obtaining the user terminal username and password, and send the request to the access gateway. After receiving the username and password sent by the user terminal, the gateway sends the username and password to the CP, and the CP sends the username and password as authentication information to the AUSF.
需要说明的是，在本实施例中，虽然challenge值由CP生成，但是challenge值可能是鉴权向量中的某个参数，在这种情况下，AUSF在响应固网接入点标识生成鉴权向量之后，即可直接从鉴权向量中获取challenge值，因此，此种实施场景中，由于AUSF已经获知challenge值，所以，CP在向AUSF发送用户名和密码时，无需携带challenge值。当然，在另外一种实施场景中，如果challenge值不是从鉴权向量直接获取，而是由CP生成，那么，CP在向AUSF发送用户名和密码的同时，应当将challenge值一起发送。具体的，本发明实施例此处不再详述。It should be noted that, in this embodiment, although the challenge value is generated by the CP, the challenge value may be a parameter in the authentication vector. In this case, the AUSF generates the authentication in response to the fixed network access point identifier. After the vector, the challenge value can be obtained directly from the authentication vector. Therefore, in this implementation scenario, since the AUSF already knows the challenge value, the CP does not need to carry the challenge value when sending the username and password to the AUSF. Of course, in another implementation scenario, if the challenge value is not directly obtained from the authentication vector but generated by the CP, the CP should send the challenge value together while sending the username and password to the AUSF. Specifically, the embodiments of the present invention are not described in detail herein.
此外，在第三种可选实施方式中，当接入信息的内容包括NAI和固网接入点标识时，CP可以直接将NAI和固网接入点标识作为鉴权信息发送到AUSF。In addition, in a third optional implementation manner, when the content of the access information includes the NAI and the fixed network access point identifier, the CP may directly send the NAI and the fixed network access point identifier as the authentication information to the AUSF.
由现有技术可知，固网核心网功能架构中，BNG的功能包括与用户终端执行信息交互和鉴权控制，从而导致与本申请的网络功能架构不能兼容，而由上述描述可知，本申请中，由接入网关执行与用户终端执行信息交互，由CP执行鉴权控制，从而能够将固网核心网的功能架构与本申请网络设备的功能架构相互兼容，进而能够完善本申请网络设备的功能，使其能够接入支持不同协议栈的用户终端。It can be seen from the prior art that in the functional network architecture of the fixed network, the function of the BNG includes performing information interaction and authentication control with the user terminal, thereby causing incompatibility with the network function architecture of the present application. The access gateway performs the information exchange with the user terminal, and the CP performs the authentication control, so that the functional architecture of the fixed network core network and the functional architecture of the network device of the present application are compatible with each other, thereby improving the function of the network device of the present application. It enables access to user terminals that support different protocol stacks.
与上述描述相对应的，当CP接收到AUSF发送的鉴权通过的消息后，CP中的SMF可以为相应的用户终端配置IP地址和DHCP服务器地址中的至少一个，并且，在配置IP地址和/或DHCP服务器地址之后，CP中的移动功能实体AMF生成NAS回复消息，将IP地址和DHCP服务器地址中的至少一个携带在NAS回复消息中，得到网络接口信息。Corresponding to the above description, after the CP receives the message of the authentication pass sent by the AUSF, the SMF in the CP may configure at least one of the IP address and the DHCP server address for the corresponding user terminal, and configure the IP address and After the DHCP server address, the mobile function entity AMF in the CP generates a NAS reply message, and carries at least one of the IP address and the DHCP server address in the NAS reply message to obtain network interface information.
其中，需要指出的是，NAS回复消息中包括位置区标识，而位置区标识是CP为移动终端分配的位置区标识，由于本方案中，用户终端是固网终端，无需CP分配位置区标识，因此，本实施例中，该位置区标识可以设置为空值)，或者可以为用户终端分配固网区域标识、特殊位置区标识或线路标识，具体的，可以根据需求设置，本申请此处不再详述。It should be noted that the NAS reply message includes the location area identifier, and the location area identifier is the location area identifier that the CP allocates to the mobile terminal. Because the user terminal is a fixed network terminal in this solution, the CP does not need to allocate the location area identifier. Therefore, in this embodiment, the location area identifier may be set to a null value, or the user terminal may be assigned a fixed network area identifier, a special location area identifier, or a line identifier. Specifically, the location identifier may be set according to requirements. More details.
需要指出的是，由于用户终端所发送的消息是PPPoE/IPoE消息，因此，用户终端支持PPPoE/IPoE协议栈，所以，当接入网关接收到CP发送的网络接口信息时，可以读取网络接口信息中的IP地址和DHCP服务器地址中的至少一个，然后，将IP地址或者和DHCP服务器地址中的至少一个通过PPPoE流程中的IP配置消息或者NCP消息发送给用户终端，或者，将IP地址或者和DHCP服务器地址中的至少一个通过DHCP流程中的IP配置消息发送给用户终端。It should be noted that, since the message sent by the user terminal is a PPPoE/IPoE message, the user terminal supports the PPPoE/IPoE protocol stack. Therefore, when the access gateway receives the network interface information sent by the CP, the network interface can be read. At least one of an IP address and a DHCP server address in the information, and then transmitting at least one of the IP address or the DHCP server address to the user terminal through an IP configuration message or an NCP message in the PPPoE process, or At least one of the DHCP server addresses is sent to the user terminal through an IP configuration message in the DHCP process.
此外，在另一种实施场景中，由于接入网关能够识别用户终端是固网终端，因此，接入网关可以直接对用户终端直接执行鉴权，并在鉴权通过后，将鉴权通过的信息与用户终端的接入信息一起封装成NAS/EAP消息发送给CP，CP可以直接为用户终端配置网络接口信息，并发送给接入网关。在此种实施场景中，除了鉴权的过程，其他执行过程详见上述描述，本申请此处不再赘述。In addition, in another implementation scenario, since the access gateway can identify that the user terminal is a fixed network terminal, the access gateway can directly perform authentication on the user terminal, and after the authentication is passed, the authentication is passed. The information is encapsulated into a NAS/EAP message and sent to the CP together with the access information of the user terminal. The CP can directly configure the network interface information for the user terminal and send the information to the access gateway. In this implementation scenario, in addition to the process of authentication, other execution processes are described in detail above, and are not described herein again.
综上可知，本申请所述的网络接入方法，能够兼容不同的协议栈类型，并且，能够通过分散固网核心网功能网元的职能，兼容固网核心网的功能，从而能够使得用户终端接入网络时，不受限制，进而通过布置一张核心网即可进行全业务运营，不仅节省资源，而且便于网络维护。In summary, the network access method described in this application can be compatible with different protocol stack types, and can be compatible with the functions of the fixed network core network by dispersing the functions of the fixed network core network function network element, thereby enabling the user terminal. When accessing the network, there is no restriction, and then a full-service operation can be performed by arranging a core network, which not only saves resources but also facilitates network maintenance.
上述实施例从概述的角度，阐述了本方案，为了使本领域技术人员更加清楚、详细的了解本方案，下面将分别对应用户终端发送的PPPoE消息和IPoE消息，结合实例对本方案进行阐述。The foregoing embodiment describes the solution from an overview point of view. In order to enable the person skilled in the art to understand the solution more clearly and in detail, the following will respectively correspond to the PPPoE message and the IPoE message sent by the user terminal, and the solution will be described with reference to an example.
请参见图3，图3是本申请提供的网络接入方法的第一种实施方式的信息交互示意图。图3所示的实施例中，用户终端发起的是PPPoE接入流程，接入网关是ngPDG。具体的，步骤S21，用户终端向ngPDG发送PADI消息；步骤S22，ngPDG向所述用户终端发送PPPoE有效发现提供包PADO消息，以响应所述用户终端的请求；步骤S23，用户终端选择所述ngPDG的PADO消息之后，向所述ngPDG发送PPPoE有效发现请求PADR消息；步骤S24，在接收到所述用户终端发送的PADR消息后，为所述用户终端分配唯一PPPoE会话标识Session-ID；步骤S25，ngPDG向所述用户终端发送有效发现会话确认PADS消息，所述PADS消息中包括Session-ID；步骤S26，ngPDG生成challenge值，并将该challenge值发送到所述用户终端；步骤S27，用户终端将challenge值与初始密码做MD5算法，生成HASH后的密码challenge-password。Referring to FIG. 3, FIG. 3 is a schematic diagram of information interaction of a first implementation manner of a network access method provided by the present application. In the embodiment shown in FIG. 3, the user terminal initiates a PPPoE access procedure, and the access gateway is an ngPDG. Specifically, in step S21, the user terminal sends a PADI message to the ngPDG; in step S22, the ngPDG sends a PPPoE effective discovery providing packet PADO message to the user terminal in response to the request of the user terminal; and in step S23, the user terminal selects the ngPDG. After the PADO message, the PPPoE valid discovery request PADR message is sent to the ngPDG; after receiving the PADR message sent by the user terminal, the user terminal is assigned a unique PPPoE session identifier Session-ID; The ngPDG sends a valid discovery session acknowledgement PADS message to the user terminal, the PADS message includes a Session-ID; in step S26, the ngPDG generates a challenge value, and sends the challenge value to the user terminal; in step S27, the user terminal The challenge value and the initial password are MD5 algorithm, and the password challenge-password after HASH is generated.
需要指出的是，上述步骤是用户终端与ngPDG之间进行PPPoE会话的过程，该过程中的信息协议支持PPPoE协议栈。由于该过程是本领域技术人员所熟知的过程，因此，本申 请不再赘述。It should be noted that the above steps are a process of performing a PPPoE session between the user terminal and the ngPDG, and the information protocol in the process supports the PPPoE protocol stack. Since this process is a process well known to those skilled in the art, this application will not be repeated.
基于步骤S21，ngPDG已经能够通过PADI消息数据包头的类型标识判断出用户终端所发送的消息是PPPoE消息，因此，步骤S28，ngPDG读取用户终端的Session-ID，通过设置N2ID＝Session-ID，将Session-ID携带在N2消息中，并将该N2消息发送到CP。Based on step S21, the ngPDG can determine that the message sent by the user terminal is a PPPoE message by using the type identifier of the PADI message packet header. Therefore, in step S28, the ngPDG reads the session-ID of the user terminal, and sets the N2ID=Session-ID. The Session-ID is carried in the N2 message and the N2 message is sent to the CP.
当然，上述仅为一种实施方式，本实施例中，还可以通过在NAS消息中携带Session-ID。或者，ngPDG读取用户终端的MAC地址，并生成NAI＝MAC@domain name，其中，上述域标识domainname可以为固网运营商PLMN信息。然后，将NAI携带在EAP-Response消息中。当然，本申请实施例中，ngPDG可以将Session-ID或者NAI对应的NAS/EAP消息发送到CP。Of course, the foregoing is only one implementation manner. In this embodiment, the Session-ID may also be carried in the NAS message. Alternatively, the ngPDG reads the MAC address of the user terminal, and generates a NAI=MAC@domain name, where the domain identifier domainname can be the fixed network operator PLMN information. The NAI is then carried in the EAP-Response message. Of course, in the embodiment of the present application, the ngPDG may send a NAS/EAP message corresponding to the Session-ID or the NAI to the CP.
此外，需要指出的是，本申请实施例中，Session-ID或者MAC地址作为用户终端的设备标识，而ngPDG在NAS消息中设置请求类型为初始附着，设置PDN类型为IPv4地址和IPv6地址，或者基于配置，设置PDN类型为only IPv4或only IPv6地址。In addition, it should be noted that, in the embodiment of the present application, the Session-ID or the MAC address is used as the device identifier of the user terminal, and the ngPDG sets the request type as the initial attachment in the NAS message, and sets the PDN type to the IPv4 address and the IPv6 address, or Set the PDN type to only IPv4 or only IPv6 address based on the configuration.
步骤S29，CP读取并存储Session-ID和/或MAC地址，并向ngPDG发送携带EAP-Request消息的N2消息。需要指出的是，该EAP-Request消息可以包括获取用户终端用户名和challenge-password的请求信息。步骤S210，ngPDG响应请求信息，从用户终端获取其用户名和challenge-password，并将用户名、challenge值和challenge-password携带在EAP消息中，发送到CP。In step S29, the CP reads and stores the Session-ID and/or the MAC address, and sends an N2 message carrying the EAP-Request message to the ngPDG. It should be noted that the EAP-Request message may include request information for obtaining a user terminal username and a challenge-password. Step S210: The ngPDG obtains the user name and the challenge-password from the user terminal in response to the request information, and carries the username, the challenge value, and the challenge-password in the EAP message, and sends the message to the CP.
其中，由于用户终端的用户名和challenge-password等信息，安全等级相对较高，因此，在本实施例中，在ngPDG向CP发送用户名和challenge-password之前，CP可以与ngPDG建立安全通道，使ngPDG通过安全通道向CP发送用户名和challenge-password。其中，该安全通道可以但不限于TTLS安全通道。The security level is relatively high because the user name and the challenge-password of the user terminal are relatively high. Therefore, in this embodiment, before the ngPDG sends the username and the challenge-password to the CP, the CP can establish a secure channel with the ngPDG to make the ngPDG. Send the username and challenge-password to the CP through the secure channel. The secure channel can be, but is not limited to, a TTLS secure channel.
步骤S211，CP从EAP消息中提取用户名，challenge-password和challenge值，并将用户名，challenge-password和Challenge值发送给AUSF，从而触发AUSF执行鉴权。Step S211, the CP extracts the username, challenge-password, and challenge values from the EAP message, and sends the username, challenge-password, and Challenge values to the AUSF, thereby triggering the AUSF to perform authentication.
具体的，AUSF可以先基于用户名查找签约数据，并将签约数据中用户名对应的密码与所接收的challenge值做HASH运算，得到运算结果，然后，将上述运算结果和收到的challenge-password进行比较，如果二者相同，用户鉴权认证通过；否则，用户鉴权认证失败。Specifically, the AUSF may first search for the subscription data based on the username, and perform a HASH operation on the password corresponding to the username in the subscription data and the received challenge value to obtain an operation result, and then, the operation result and the received challenge-password. For comparison, if the two are the same, the user authentication is passed; otherwise, the user authentication fails.
步骤S212，当AUSF执行鉴权认证通过之后，向CP发送鉴权成功的通知信息，其中，通知信息中包括用户签约数据。步骤S213，CP为用户终端分配IP地址，并将所分配的IP地址承载在N2消息中发送给ngPDG。其中，本实施例中，可以将IP地址携带在NAS消息中，具体的，NAS消息中的位置区标识可以设置为空值。步骤S214，ngPDG向用户终端发送鉴权通过的通知信息。步骤S215，用户终端向ngPDG发起NCP协商，获取IP地址，并 根据所述IP地址接入网络。Step S212, after the AUSF performs the authentication authentication, the notification information of the successful authentication is sent to the CP, where the notification information includes the user subscription data. In step S213, the CP allocates an IP address to the user terminal, and the assigned IP address is carried in the N2 message and sent to the ngPDG. In this embodiment, the IP address can be carried in the NAS message. Specifically, the location area identifier in the NAS message can be set to a null value. Step S214, the ngPDG sends the notification information of the authentication pass to the user terminal. Step S215: The user terminal initiates an NCP negotiation to the ngPDG, obtains an IP address, and accesses the network according to the IP address.
由本实施例的描述可知，本方案中，ngPDG与用户终端之间的交互信息支持PPPoE协议栈，ngPDG与CP之间的交互信息支持NAS/EAP消息，即，ngPDG能够识别并双向转换PPPoE协议栈和NAS/EAP协议栈的消息，从而使得网络设备能够兼容两种协议栈。As shown in the description of the present embodiment, in the present solution, the interaction information between the ngPDG and the user terminal supports the PPPoE protocol stack, and the interaction information between the ngPDG and the CP supports the NAS/EAP message, that is, the ngPDG can identify and bidirectionally convert the PPPoE protocol stack. And NAS/EAP protocol stack messages, enabling network devices to be compatible with both protocol stacks.
当然，图3所示的实施例是本方案的一种可选实施方式，本申请的技术方案不限于此。Of course, the embodiment shown in FIG. 3 is an optional implementation manner of the solution, and the technical solution of the present application is not limited thereto.
请参见图3，图4为本申请提供的网络接入方法的第二种实施方式的信息交互示意图。图4所示的实施例，用户终端所发起的也是PPPoE接入流程，具体的，包括以下流程：Referring to FIG. 3, FIG. 4 is a schematic diagram of information interaction of a second implementation manner of a network access method provided by the present application. In the embodiment shown in FIG. 4, the user terminal initiates a PPPoE access process. Specifically, the following processes are included:
其中，步骤S31到步骤S35是用户终端与ngPDG之间进行PPPoE会话的过程，与图3所示的实施例中，步骤S21到步骤S25相同，详情请参见图3所示实施例的描述，本申请此处不再赘述。Step S31 to step S35 are the process of performing a PPPoE session between the user terminal and the ngPDG. In the embodiment shown in FIG. 3, the steps are the same as the step S21 to the step S25. For details, refer to the description of the embodiment shown in FIG. The application will not be repeated here.
步骤S36，ngPDG读取用户终端的Session-ID或者MAC地址，并识别PPPOE的连接来源，确定固网接入点标识。其中，本实施例中，固网接入点标识是线路标识。步骤S37，ngPDG将Session-ID或者MAC地址，以及线路标识封装成NAS/EAP消息，并将NAS/EAP消息发送给CP。步骤S38，CP读取并存储Session-ID或MAC地址，以及线路标识，并将线路标识发送给AUSF。步骤S39，AUSF根据线路标识获取该线路对应的鉴权向量，并将该鉴权向量发送给CP。步骤S310，CP基于鉴权向量生成challenge值。步骤S311，CP与ngPDG建立安全通道。步骤S312，CP通过安全通道向ngPDG发送EAP-Request消息。其中，本实施例中，EAP-Request消息中包括challenge值。步骤S313，ngPDG将challenge值与获取用户名和challenge-password的请求一起发送给用户终端。Step S36, the ngPDG reads the Session-ID or MAC address of the user terminal, identifies the connection source of the PPPOE, and determines the fixed network access point identifier. In this embodiment, the fixed network access point identifier is a line identifier. In step S37, the ngPDG encapsulates the Session-ID or MAC address and the line identifier into a NAS/EAP message, and sends the NAS/EAP message to the CP. In step S38, the CP reads and stores the Session-ID or MAC address, and the line identifier, and sends the line identifier to the AUSF. Step S39: The AUSF acquires an authentication vector corresponding to the line according to the line identifier, and sends the authentication vector to the CP. In step S310, the CP generates a challenge value based on the authentication vector. In step S311, the CP establishes a secure channel with the ngPDG. Step S312, the CP sends an EAP-Request message to the ngPDG through the secure channel. In this embodiment, the value of the challenge is included in the EAP-Request message. In step S313, the ngPDG sends the challenge value to the user terminal together with the request for obtaining the username and the challenge-password.
步骤S314至步骤S320的操作过程，与图3所示实施例中，步骤S210至步骤S215的过程相似，本实施例此处不再赘述。The operation of the step S314 to the step S320 is similar to the process of the step S210 to the step S215 in the embodiment shown in FIG. 3, and details are not described herein again.
需要说明的是，本实施例中，challenge值可以是鉴权向量中的随机数，因此，在步骤S39中，AUSF生成鉴权向量之后，可以直接读取鉴权向量中的随机数作为challenge值，所以，本实施例中，AUSF已经获知challenge值，进而，本实施例与图3所示实施例的区别在于，CP向AUSF发送用户名和challenge-password时，不携带challenge值，详见图4中步骤S316的描述，本实施例此处不再赘述。It should be noted that, in this embodiment, the challenge value may be a random number in the authentication vector. Therefore, after the AUSF generates the authentication vector in step S39, the random number in the authentication vector may be directly read as the challenge value. Therefore, in this embodiment, the AUSF has already learned the challenge value. Further, the difference between the embodiment and the embodiment shown in FIG. 3 is that when the CP sends the username and the challenge-password to the AUSF, the challenge value is not carried, as shown in FIG. 4 . The description of step S316 in this embodiment is not described herein again.
此外，本实施例中，challenge值由CP生成，因此，ngPDG只将用户名和challenge-password发送给CP即可。此外，CP在将所分配的IP地址携带在NAS消息中时，可以将NAS消息中的位置区标识设置为空值或者线路标识。In addition, in this embodiment, the challenge value is generated by the CP, and therefore, the ngPDG only sends the username and the challenge-password to the CP. In addition, when the CP carries the assigned IP address in the NAS message, the location area identifier in the NAS message can be set to a null value or a line identifier.
在图3所示实施例的基础上，ngPDG用于与用户终端执行PPPoE会话，并且还要执行两种协议的转换，因此，造成ngPDG的数据处理量较大，操作较为复杂。基于此，本实施例中，由CP生成challenge值，从而能够减少ngPDG的数据处理量，简化ngPDG的操作。On the basis of the embodiment shown in FIG. 3, the ngPDG is used to perform a PPPoE session with the user terminal, and the conversion of the two protocols is also performed. Therefore, the data processing capacity of the ngPDG is large, and the operation is complicated. Based on this, in the present embodiment, the challenge value is generated by the CP, so that the data processing amount of the ngPDG can be reduced, and the operation of the ngPDG can be simplified.
上述两实施例均是以PPPoE协议栈为例，对本申请的描述，为了使本领域技术人员能够更加全面的理解本方案，下面以IPoE协议栈为例，介绍本申请的操作过程。The above two embodiments are all based on the PPPoE protocol stack. For the description of the present application, in order to enable the person skilled in the art to understand the solution more fully, the following describes the operation process of the present application by taking the IPoE protocol stack as an example.
参见图5，图5为本申请提供的网络接入方法的第三种实施方式的信息交互示意图。本实施例中，用户终端发起的是IPoE接入流程。具体的，步骤S41，用户终端与ngPDG建立层二连接，并向ngPDG发送DHCP发现消息。步骤S42，ngPDG从DHCP发现消息中获取用户终端的MAC地址，并识别IPOE的连接来源，确定其固网接入点标识。本实施中，固网接入点标识可以是线路标识。步骤S43，ngPDG将MAC地址和线路标识封装成NAS/EAP消息，并将NAS/EAP消息发送给CP。Referring to FIG. 5, FIG. 5 is a schematic diagram of information interaction of a third implementation manner of a network access method provided by the present application. In this embodiment, the user terminal initiates an IPoE access procedure. Specifically, in step S41, the user terminal establishes a layer two connection with the ngPDG, and sends a DHCP discovery message to the ngPDG. Step S42: The ngPDG obtains the MAC address of the user terminal from the DHCP discovery message, identifies the connection source of the IPOE, and determines the fixed network access point identifier. In this implementation, the fixed network access point identifier may be a line identifier. In step S43, the ngPDG encapsulates the MAC address and the line identifier into a NAS/EAP message, and sends the NAS/EAP message to the CP.
需要指出的是，本实施例中，ngPDG也可以将预先分配的Session-ID一起发送到CP。此外，由于支持IPoE协议栈的用户终端，根据DHCP服务器自行获取IP地址，因此，获取IP地址的时间将会有延迟，所以，本实施例中，在生成NAS消息时，设置IP地址延迟获取指示。It should be noted that, in this embodiment, the ngPDG may also send the pre-assigned Session-ID to the CP. In addition, since the user terminal that supports the IPoE protocol stack obtains the IP address according to the DHCP server, the time for obtaining the IP address will be delayed. Therefore, in this embodiment, when the NAS message is generated, the IP address delay acquisition indication is set. .
步骤S44，CP提取并存储MAC地址与线路标识，并将MAC地址与线路标识发送到AUSF，以触发AUSF执行鉴权。Step S44, the CP extracts and stores the MAC address and the line identifier, and sends the MAC address and the line identifier to the AUSF to trigger the AUSF to perform authentication.
在本实施例中，AUSF基于线路标识查找用户签约数据，并匹配所接收的MAC地址与签约数据中的MAC地址，如果匹配成功，则鉴权认证通过，否则，鉴权认证失败。In this embodiment, the AUSF searches for the user subscription data based on the line identifier, and matches the received MAC address with the MAC address in the subscription data. If the matching succeeds, the authentication authentication passes; otherwise, the authentication authentication fails.
当鉴权认证通过后，步骤S45，AUSF将用户签约数据发送给CP。步骤S46，CP为用户终端分配DHCP服务器地址，并通过NAS消息或N2消息发送给ngPDG。步骤S47，ngPDG发送DHCP offer消息给用户终端，其中，该DHCP offer消息中携带有CP分配的DHCP服务器地址。After the authentication is passed, in step S45, the AUSF sends the user subscription data to the CP. Step S46: The CP allocates a DHCP server address to the user terminal, and sends the address to the ngPDG through a NAS message or an N2 message. In step S47, the ngPDG sends a DHCP offer message to the user terminal, where the DHCP offer message carries the DHCP server address assigned by the CP.
需要说明的是，在本实施例中，CP也可以不为用户终端分配DHCP服务器地址，那么，此种实施场景下，CP仅向ngPDG发送鉴权认证通过的通知信息即可，ngPDG为用户终端分配DHCP服务器地址。It should be noted that, in this embodiment, the CP may not allocate a DHCP server address to the user terminal. In this implementation scenario, the CP only sends the notification information of the authentication authentication to the ngPDG, and the ngPDG is the user terminal. Assign a DHCP server address.
步骤S48，用户终端访问DHCP服务器地址，从DHCP服务器获取IP地址，并根据所述IP地址接入网络。Step S48, the user terminal accesses the DHCP server address, obtains an IP address from the DHCP server, and accesses the network according to the IP address.
需要指出的是，本实施例中，在执行步骤S46时，CP也可以为用户终端分配IP地址，并在后面的流程中将IP地址与DHCP服务器地址一起发送到用户终端，使得用户终端根据CP所分配的IP地址接入网络，并且用户终端在以后的网络操作过程中，需要获取其他的IP地址时，可以通过访问DHCP服务器地址获得。It should be noted that, in this embodiment, when performing step S46, the CP may also allocate an IP address to the user terminal, and send the IP address to the user terminal together with the DHCP server address in the following process, so that the user terminal is configured according to the CP. The assigned IP address is connected to the network, and the user terminal can obtain the IP address by accessing the DHCP server address during the subsequent network operation.
此外，本实施例中，CP同样可以生成challenge值，并将challenge值通过NAS消息发送到ngPDG，以使用户终端根据challenge值生成challenge-password。具体的，详见图4所示实施例中，步骤S38至步骤S312的执行过程，本实施例此处不再详述。In addition, in this embodiment, the CP may also generate a challenge value, and send the challenge value to the ngPDG through the NAS message, so that the user terminal generates a challenge-password according to the challenge value. Specifically, the implementation process of step S38 to step S312 in the embodiment shown in FIG. 4 is not detailed in this embodiment.
当然，可以看出，上述仅为本申请的几种可选实施方式，对本申请的技术方案不构成任何限制，上述实施例方式中，接入网关也可以替换为AGF，接入信息也可以替换为其他适合的消息，具体的，本申请此处不再一一详述。Of course, it can be seen that the foregoing is only a few optional implementation manners of the present application, and does not impose any limitation on the technical solution of the present application. In the foregoing embodiment manner, the access gateway may also be replaced with an AGF, and the access information may also be replaced. For other suitable messages, specifically, the application is not described in detail herein.
综合上述，本申请提供的网络接入方法，当网络设备所支持的协议栈与用户终端所支持的协议栈不兼容时，网络设备中的ngPDG能够识别用户终端所发送的消息，并能够将消息中的信息转换为网络设备中其他网元能够识别的消息类型，从而能够使得用户终端接入网络时，不受协议栈的限制，进而通过布置一张核心网即可进行全业务运营，不仅节省资源，而且便于网络维护。In combination, in the network access method provided by the present application, when the protocol stack supported by the network device is incompatible with the protocol stack supported by the user terminal, the ngPDG in the network device can identify the message sent by the user terminal, and can send the message. The information in the network device is converted into a message type that can be identified by other network elements in the network device, so that when the user terminal accesses the network, it is not restricted by the protocol stack, and then a full-service operation can be performed by arranging a core network, thereby saving not only Resources, and easy network maintenance.
与上述网络接入方法相对应的，本申请还提供了一种网络接入装置，参见图6，图6为本申请提供的网络接入装置的结构示意图，该装置用于执行图2至图5所示的网络接入方法。包括：获取模块61、封装模块62、发送模块63和接收模块64。其中，获取模块61，用于在接收到用户终端发送的点到点连接协议PPPoE消息或动态主机配置协议IPoE消息时，获取PPPoE消息或IPoE消息包含的用户终端的接入信息；封装模块62，用于将接入信息封装成非接入层NAS消息或可扩展身份验证协议EAP消息；发送模块63，用于将NAS消息或EAP消息发送到控制面功能实体CP；接收模块64，用于接收CP发送的网络接口信息并发送给用户终端，使得用户终端接入网络。Corresponding to the foregoing network access method, the present application further provides a network access device. Referring to FIG. 6, FIG. 6 is a schematic structural diagram of a network access device provided by the present application, where the device is used to perform FIG. 2 to FIG. The network access method shown in 5. The method includes an obtaining module 61, a packaging module 62, a sending module 63, and a receiving module 64. The obtaining module 61 is configured to acquire the access information of the user terminal included in the PPPoE message or the IPoE message when receiving the point-to-point connection protocol PPPoE message or the dynamic host configuration protocol IPoE message sent by the user terminal; the encapsulating module 62, For receiving the access information into a non-access stratum NAS message or an extensible authentication protocol EAP message; the sending module 63, configured to send the NAS message or the EAP message to the control plane function entity CP; and the receiving module 64, for receiving The network interface information sent by the CP is sent to the user terminal, so that the user terminal accesses the network.
在一个具体实施例中，封装模块62包括生成单元和发送单元，其中，生成单元，用于生成NAS请求消息，将接入信息携带在NAS请求消息中，其中，NAS请求消息是注册请求消息或者协议数据单元PDU会话建立请求消息；发送单元，用于发送初始化用户终端消息，将NAS请求消息携带在初始化用户终端消息中。此外，在本实施例中，发送单元，还用于发送初始化用户终端消息，将接入信息中的固网接入点标识和会话标识中的至少一个携带在初始化用户终端消息中；生成单元，还用于生成NAS请求消息，将接入信息中的用户终端标识携带在NAS请求消息中，并将NAS请求消息携带在初始化用户终端消息中。In a specific embodiment, the encapsulating module 62 includes a generating unit and a sending unit, where the generating unit is configured to generate a NAS request message, where the access information is carried in the NAS request message, where the NAS request message is a registration request message or a protocol data unit PDU session establishment request message; a sending unit, configured to send an initialization user terminal message, and carry the NAS request message in the initialization user terminal message. In addition, in this embodiment, the sending unit is further configured to send an initial user terminal message, and carry at least one of the fixed network access point identifier and the session identifier in the access information in the initialization user terminal message; It is also used to generate a NAS request message, carry the user terminal identifier in the access information in the NAS request message, and carry the NAS request message in the initialized user terminal message.
在另一个实施例中，生成单元，还用于生成EAP消息，将接入信息携带在EAP消息中；并生成注册请求消息，将EAP消息携带在注册请求消息中；发送单元，还用于发送初始化用户终端消息，将注册请求携带在初始化用户终端消息中。In another embodiment, the generating unit is further configured to generate an EAP message, and carry the access information in the EAP message; and generate a registration request message, and carry the EAP message in the registration request message; the sending unit is further configured to send The user terminal message is initialized, and the registration request is carried in the initialization user terminal message.
此外，本装置还包括配置模块，其中，在本实施例中，发送模块63，还用于当接入信息包括用户终端标识，和固网接入点标识中的至少一个时，将固网接入点标识和用户终端标识中的至少一个发送到鉴权认证实体；接收模块64，还用于接收鉴权认证实体根据固网接入点标识和用户终端标识中的至少一个进行鉴权认证的结果；配置模块，用于当鉴权认证的结果是鉴权通过时，为用户终端配置网络接口信息。In addition, the device further includes a configuration module, wherein, in this embodiment, the sending module 63 is further configured to: when the access information includes at least one of a user terminal identifier and a fixed network access point identifier, connect the fixed network The at least one of the ingress point identifier and the user terminal identifier is sent to the authentication and authenticating entity, and the receiving module 64 is further configured to receive, by the authentication and authenticating entity, the authentication and the authentication according to at least one of the fixed network access point identifier and the user terminal identifier. The configuration module is configured to configure network interface information for the user terminal when the result of the authentication authentication is authentication.
其中，接收模块64，具体用于在发送模块63将接入信息发送到鉴权认证实体之后，接收鉴权认证实体根据固网接入点标识发送的鉴权向量；发送模块63，还用于基于鉴权向量生成challenge值，并将challenge值发送到接入网关；并向用户终端发送获取用户名 和密码的请求；其中，请求中包括challenge值；密码是用户终端将challenge值与初始密码进行哈希运算得到的；接收模块64，还用于接收用户名和密码；发送模块63，还用于将用户名和密码发送到CP；并将用户名和密码发送给鉴权认证实体，使得鉴权认证实体基于用户名和密码执行鉴权。The receiving module 64 is specifically configured to: after the sending module 63 sends the access information to the authentication and authenticating entity, receive the authentication vector sent by the authentication and authenticating entity according to the identifier of the fixed network access point; and the sending module 63 is further configured to: Generating a challenge value based on the authentication vector, and sending the challenge value to the access gateway; and sending a request for obtaining the username and password to the user terminal; wherein the request includes a challenge value; the password is that the user terminal performs the challenge value with the initial password. The receiving module 64 is further configured to receive a username and a password; the sending module 63 is further configured to send the username and password to the CP; and send the username and password to the authentication and authenticating entity, so that the authentication and authenticating entity is based on The username and password are authenticated.
此外，配置模块，具体用于为用户终端分配互联网协议地址IP地址和主机配置协议DHCP服务器地址中的至少一个，并生成NAS回复消息，将IP地址和DHCP服务器中的至少一个携带在NAS回复消息中，得到网络接口信息。In addition, the configuration module is specifically configured to allocate at least one of an internet protocol address IP address and a host configuration protocol DHCP server address to the user terminal, and generate a NAS reply message, and carry at least one of the IP address and the DHCP server in the NAS reply message. In the middle, get the network interface information.
发送模块63，在另一个实施例中，具体用于读取网络接口信息中的IP地址和DHCP服务器地址中的至少一个，并将IP地址和DHCP服务器地址中的至少一个通过IP配置消息或网络控制协议NCP消息发送给用户终端。The sending module 63, in another embodiment, specifically for reading at least one of an IP address and a DHCP server address in the network interface information, and passing at least one of the IP address and the DHCP server address through an IP configuration message or network The control protocol NCP message is sent to the user terminal.
此外，本申请还提供了一种网络设备。参见图7，图7为本申请提供的网络设备的结构示意图，该设备用于执行图2至图5所示的网络接入方法。包括：处理器11和通信接口12。其中，通信接口12，用于接收用户终端发送的PPPoE消息或IPoE消息；处理器11，用于获取PPPoE消息或IPoE消息包含的用户终端的接入信息；将接入信息封装成NAS消息或EAP消息；通信接口12，向用户终端发送网络接口信息，使得用户终端接入网络。In addition, the present application also provides a network device. Referring to FIG. 7, FIG. 7 is a schematic structural diagram of a network device provided by the present application, where the device is used to perform the network access method shown in FIG. 2 to FIG. 5. The processor 11 and the communication interface 12 are included. The communication interface 12 is configured to receive a PPPoE message or an IPoE message sent by the user terminal, and the processor 11 is configured to obtain the access information of the user terminal included in the PPPoE message or the IPoE message, and encapsulate the access information into a NAS message or an EAP. The communication interface 12 sends the network interface information to the user terminal, so that the user terminal accesses the network.
其中，处理器11将接入信息封装成NAS消息，执行为：处理器11生成NAS请求消息，将接入信息携带在NAS请求消息中；生成初始化用户终端消息，将NAS请求消息携带在初始化用户终端消息中；或者，生成初始化用户终端消息，将接入信息中的固网接入点标识和会话标识中的至少一个携带在初始化用户终端消息中；并生成NAS请求消息，将接入信息中的用户终端标识携带在NAS请求消息中，并将NAS请求消息携带在初始化用户终端消息中。其中，NAS请求消息是注册请求消息或者协议数据单元PDU会话建立请求消息。The processor 11 encapsulates the access information into a NAS message, and the processor 11 generates a NAS request message, carries the access information in the NAS request message, generates an initial user terminal message, and carries the NAS request message in the initial user. Or generating an initial user terminal message, carrying at least one of a fixed network access point identifier and a session identifier in the access information in an initial user terminal message; and generating a NAS request message, where the information is to be accessed The user terminal identifier is carried in the NAS request message, and the NAS request message is carried in the initialization user terminal message. The NAS request message is a registration request message or a protocol data unit PDU session establishment request message.
处理器11将接入信息封装成EAP消息，执行为：处理器11生成EAP消息，将接入信息携带在EAP消息中；然后，生成注册请求消息，将EAP消息携带在注册请求消息中；然后，生成初始化用户终端消息，将注册请求携带在初始化用户终端消息中。The processor 11 encapsulates the access information into an EAP message, and the processor 11 generates an EAP message, and carries the access information in the EAP message. Then, the registration request message is generated, and the EAP message is carried in the registration request message; The initial user terminal message is generated, and the registration request is carried in the initialization user terminal message.
此外，处理器11将接入信息封装成非接入层NAS消息或可扩展身份验证协议EAP消息之后，还用于根据接入信息中的用户终端标识，和固网接入点标识中的至少一个执行鉴权，并得到鉴权结果，当鉴权结果是鉴权通过时，为用户终端配置网络接口信息。具体可以执行为：处理器11根据固网接入点标识查找鉴权向量，并根据鉴权向量生成challenge值；通信接口12将challenge值发送到用户终端，并接收用户终端发送的用户名和密码；处理器11根据用户名、密码和challenge值执行鉴权，并得到鉴权结果。In addition, after the processor 11 encapsulates the access information into a non-access stratum NAS message or an extensible authentication protocol EAP message, the processor 11 is further configured to: according to the user terminal identifier in the access information, and at least the fixed network access point identifier. One performs authentication and obtains an authentication result. When the authentication result is authentication, the network interface information is configured for the user terminal. Specifically, the processor 11 searches for an authentication vector according to the fixed network access point identifier, and generates a challenge value according to the authentication vector; the communication interface 12 sends the challenge value to the user terminal, and receives the user name and password sent by the user terminal; The processor 11 performs authentication based on the username, password, and challenge value, and obtains an authentication result.
在另外一个实施例中，处理器11为用户终端配置网络接口信息执行为，通过SMF为用户终端分配互联网协议地址IP地址和主机配置协议DHCP服务器地址中的至少一个；并通过AMF生成NAS回复消息，将IP地址和所述DHCP服务器中的至少一个携带在NAS回复 消息中，得到网络接口信息。In another embodiment, the processor 11 configures the network interface information for the user terminal to perform at least one of the Internet Protocol address IP address and the host configuration protocol DHCP server address for the user terminal through the SMF; and generates the NAS reply message by using the AMF. And carrying at least one of the IP address and the DHCP server in the NAS reply message to obtain network interface information.
通信接口12向用户终端发送网络接口信息，具体执行为：通信接口通过IP配置消息或网络控制协议NCP消息将IP地址和DHCP服务器地址中的至少一个发送到用户终端。The communication interface 12 sends the network interface information to the user terminal, and the specific implementation is: the communication interface sends at least one of the IP address and the DHCP server address to the user terminal by using an IP configuration message or a network control protocol NCP message.
此外，本领域技术人员应明白，本发明的实施例可提供为方法、装置(设备)、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。Moreover, those skilled in the art will appreciate that embodiments of the invention may be provided as a method, apparatus (device), or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
本发明是参照根据本发明实施例的方法、装置(设备)和计算机程序产品的信息交互图来描述的。应理解可由计算机程序指令实现信息交互图中的每一流程、以及信息交互图中的流程的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程中指定的功能的装置。The present invention has been described with reference to an information interaction diagram of a method, apparatus (device) and computer program product according to an embodiment of the present invention. It should be understood that each process in the information interaction diagram, and a combination of processes in the information interaction diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. A device that implements the functions specified in one or more processes of a flowchart.
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程中指定的功能。The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The device implements the functions specified in one or more flows of the flowchart.
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程中指定的功能的步骤。These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more flows of the flowchart.
相应的，本发明实施例还提供了一种计算机存储介质，该计算机存储介质可存储有程序，该程序执行时可实现图1至图5所示的网络接入方法各实施例中的部分或全部步骤，具体的，本发明实施例此处不再详述。Correspondingly, the embodiment of the present invention further provides a computer storage medium, where the computer storage medium can store a program, and when the program is executed, the part of the network access method shown in FIG. 1 to FIG. All the steps, specifically, the embodiments of the present invention are not described in detail herein.
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。While the preferred embodiment of the invention has been described, it will be understood that Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and the modifications and
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and modifications of the invention

Claims (20)

  1. 一种网络接入方法，其特征在于，所述方法包括：A network access method, the method comprising:
    当所述接入网关接收到用户终端发送的点到点连接协议PPPoE消息或动态主机配置协议IPoE消息时，所述接入网关获取所述PPPoE消息或所述IPoE消息包含的所述用户终端的接入信息；When the access gateway receives the point-to-point connection protocol PPPoE message or the dynamic host configuration protocol IPoE message sent by the user terminal, the access gateway acquires the PPPoE message or the user terminal included in the IPoE message. Access information
    所述接入网关将所述接入信息封装成非接入层NAS消息或可扩展身份验证协议EAP消息；The access gateway encapsulates the access information into a non-access stratum NAS message or an extensible authentication protocol EAP message;
    所述接入网关将所述NAS消息或所述EAP消息发送到控制面功能实体CP；The access gateway sends the NAS message or the EAP message to the control plane function entity CP;
    所述接入网关接收所述CP发送的网络接口信息并发送给所述用户终端，使得所述用户终端接入网络。The access gateway receives the network interface information sent by the CP and sends the information to the user terminal, so that the user terminal accesses the network.
  2. 如权利要求1所述的网络接入方法，其特征在于，The network access method according to claim 1, wherein
    所述接入信息包括会话标识、用户终端标识和固网接入点标识中的至少一个；其中，The access information includes at least one of a session identifier, a user terminal identifier, and a fixed network access point identifier;
    所述会话标识是所述接入网关为所述用户终端分配的；The session identifier is allocated by the access gateway to the user terminal;
    所述用户终端标识是用户终端永久标识，用户终端临时标识，用户终端物理MAC地址，用户终端网络接入标识NAI，用户终端用户名，和代理远端标识中的至少一个；The user terminal identifier is at least one of a permanent identifier of the user terminal, a temporary identifier of the user terminal, a physical MAC address of the user terminal, a network access identifier NAI of the user terminal, a user terminal user name, and a proxy remote identifier;
    所述固网接入点标识是线路标识、物理位置标识和逻辑标识中的至少一个。The fixed network access point identifier is at least one of a line identifier, a physical location identifier, and a logical identifier.
  3. 如权利要求1或2所述的网络接入方法，其特征在于，所述接入网关将所述接入信息封装成NAS消息包括：The network access method according to claim 1 or 2, wherein the encapsulating the access information into the NAS message by the access gateway comprises:
    所述接入网关生成NAS请求消息，将所述接入信息携带在所述NAS请求消息中，其中，所述NAS请求消息是注册请求消息或者协议数据单元PDU会话建立请求消息；The access gateway generates a NAS request message, and the access information is carried in the NAS request message, where the NAS request message is a registration request message or a protocol data unit PDU session establishment request message;
    所述接入网关发送初始化用户终端消息，将所述NAS请求消息携带在所述初始化用户终端消息中；The access gateway sends an initial user terminal message, and the NAS request message is carried in the initial user terminal message;
    或者，or,
    所述接入网关发送初始化用户终端消息，将所述接入信息中的所述固网接入点标识和所述会话标识中的至少一个携带在所述初始化用户终端消息中；The access gateway sends an initial user terminal message, and carries at least one of the fixed network access point identifier and the session identifier in the access information in the initial user terminal message;
    所述接入网关生成NAS请求消息，将所述接入信息中的所述用户终端标识携带在所述NAS请求消息中，并将所述NAS请求消息携带在所述初始化用户终端消息中。The access gateway generates a NAS request message, carries the user terminal identifier in the access information in the NAS request message, and carries the NAS request message in the initial user terminal message.
  4. 如权利要求1或2所述的网络接入方法，其特征在于，所述接入网关将所述接入信息封装成EAP消息包括：The network access method according to claim 1 or 2, wherein the encapsulating the access information into the EAP message by the access gateway comprises:
    所述接入网关生成所述EAP消息，将所述接入信息携带在所述EAP消息中；The access gateway generates the EAP message, and the access information is carried in the EAP message;
    所述接入网关生成注册请求消息，将所述EAP消息携带在所述注册请求消息中；The access gateway generates a registration request message, and the EAP message is carried in the registration request message;
    所述接入网关发送初始化用户终端消息，将所述注册请求携带在所述初始化用户终端消息中。The access gateway sends an initial user terminal message, and the registration request is carried in the initial user terminal message.
  5. 如权利要求1或2所述的网络接入方法，其特征在于，当所述接入信息包括所述用户终端标识，和所述固网接入点标识中的至少一个时，在所述接入网关将所述NAS消息或所述EAP消息发送到CP之后，在所述接入网关接收所述CP发送的网络接口信息之前，还包括：The network access method according to claim 1 or 2, wherein when the access information includes at least one of the user terminal identifier and the fixed network access point identifier, After the gateway sends the NAS message or the EAP message to the CP, before the access gateway receives the network interface information sent by the CP, the method further includes:
    所述CP将所述固网接入点标识和所述用户终端标识中的至少一个发送到鉴权认证实体；Sending, by the CP, at least one of the fixed network access point identifier and the user terminal identifier to an authentication and authenticating entity;
    所述CP接收所述鉴权认证实体根据所述固网接入点标识和所述用户终端标识中的至少一个进行鉴权认证的结果；Receiving, by the CP, an authentication authentication entity according to at least one of the fixed network access point identifier and the user terminal identifier;
    当所述鉴权认证的结果是鉴权通过时，所述CP为所述用户终端配置所述网络接口信息。When the result of the authentication authentication is that the authentication is passed, the CP configures the network interface information for the user terminal.
  6. 如权利要求1或2所述的网络接入方法，其特征在于，当所述接入信息包括所述固网接入点标识时，在所述接入网关将所述NAS消息或所述EAP消息发送到CP之后，在所述接入网关接收所述CP发送的网络接口信息之前，具体包括：The network access method according to claim 1 or 2, wherein when the access information includes the fixed network access point identifier, the NAS message or the EAP is used by the access gateway After the message is sent to the CP, before the access gateway receives the network interface information sent by the CP, the method specifically includes:
    在所述CP将所述接入信息发送到鉴权认证实体之后，所述CP接收所述鉴权认证实体根据所述固网接入点标识发送的鉴权向量；After the CP sends the access information to the authentication and authenticating entity, the CP receives an authentication vector sent by the authentication and authenticating entity according to the fixed network access point identifier;
    所述CP基于所述鉴权向量生成challenge值，并将所述challenge值发送到所述接入网关；Generating, by the CP, a challenge value based on the authentication vector, and sending the challenge value to the access gateway;
    所述接入网关向所述用户终端发送获取用户名和密码的请求；其中，所述请求中包括所述challenge值；所述密码是所述用户终端将所述challenge值与初始密码进行哈希运算得到的；The access gateway sends a request for obtaining a username and a password to the user terminal, where the request includes the challenge value; the password is that the user terminal performs hash operation on the challenge value and the initial password. owned;
    所述接入网关接收所述用户名和所述密码；The access gateway receives the username and the password;
    所述接入网关将所述用户名和所述密码发送到所述CP；The access gateway sends the username and the password to the CP;
    所述CP将所述用户名和所述密码发送给所述鉴权认证实体，使得所述鉴权认证实体基于所述用户名和所述密码执行鉴权。The CP sends the username and the password to the authentication and authentication entity, so that the authentication and authenticating entity performs authentication based on the username and the password.
  7. 如权利要求5所述的网络接入方法，其特征在于，所述CP为所述用户终端配置所述网络接口信息，包括：The network access method of claim 5, wherein the configuring the network interface information for the user terminal by the CP comprises:
    所述CP中的会话管理功能实体SMF为所述用户终端分配互联网协议地址IP地址和主机配置协议DHCP服务器地址中的至少一个；The session management function entity SMF in the CP allocates at least one of an internet protocol address IP address and a host configuration protocol DHCP server address to the user terminal;
    所述CP中的移动功能实体AMF生成NAS回复消息，将所述IP地址和所述DHCP服务器中的至少一个携带在NAS回复消息中，得到所述网络接口信息。The mobile function entity AMF in the CP generates a NAS reply message, and carries at least one of the IP address and the DHCP server in a NAS reply message to obtain the network interface information.
  8. 如权利要求7所述的网络接入方法，其特征在于，The network access method according to claim 7, wherein
    所述NAS回复消息中包括位置区标识，所述位置区标识设置为空值、固网区域标识、特殊位置区标识或线路标识。The NAS reply message includes a location area identifier, and the location area identifier is set to a null value, a fixed network area identifier, a special location area identifier, or a line identifier.
  9. 如权利要求7所述的网络接入方法，其特征在于，所述接入网关接收所述CP发送的网络接口信息并发送给所述用户终端，包括：The network access method according to claim 7, wherein the access gateway receives the network interface information sent by the CP and sends the information to the user terminal, including:
    所述接入网关读取所述网络接口信息中的所述IP地址和所述DHCP服务器地址中的至少一个；The access gateway reads at least one of the IP address and the DHCP server address in the network interface information;
    所述接入网关将所述IP地址和所述DHCP服务器地址中的至少一个通过IP配置消息或网络控制协议NCP消息发送给所述用户终端。The access gateway sends at least one of the IP address and the DHCP server address to the user terminal by using an IP configuration message or a network control protocol NCP message.
  10. 如权利要求1所述的网络接入方法，其特征在于，The network access method according to claim 1, wherein
    所述PPPoE消息包括PPPOE主动发现指示PADI消息、PPPOE主动发现请求PADR消息、链路控制协议LCP消息或者NCP消息；The PPPoE message includes a PPPOE Active Discovery Indication PADI message, a PPPOE Active Discovery Request PADR message, a Link Control Protocol LCP message, or an NCP message;
    所述IPoE消息包括DHCP发现消息或DHCP请求消息。The IPoE message includes a DHCP Discover message or a DHCP Request message.
  11. 一种网络接入装置，其特征在于，所述装置包括：A network access device, characterized in that the device comprises:
    获取模块，用于在接收到用户终端发送的点到点连接协议PPPoE消息或动态主机配置协议IPoE消息时，获取所述PPPoE消息或所述IPoE消息包含的所述用户终端的接入信息；An acquiring module, configured to acquire the access information of the user terminal included in the PPPoE message or the IPoE message when receiving a point-to-point connection protocol PPPoE message or a dynamic host configuration protocol (IPoE message) sent by the user terminal;
    封装模块，用于将所述接入信息封装成非接入层NAS消息或可扩展身份验证协议EAP消息；An encapsulating module, configured to encapsulate the access information into a non-access stratum NAS message or an extensible authentication protocol EAP message;
    发送模块，用于将所述NAS消息或所述EAP消息发送到控制面功能实体CP；a sending module, configured to send the NAS message or the EAP message to a control plane function entity CP;
    接收模块，用于接收所述CP发送的网络接口信息并发送给所述用户终端，使得所述用户终端接入网络。The receiving module is configured to receive network interface information sent by the CP and send the information to the user terminal, so that the user terminal accesses the network.
  12. 如权利要求11所述的网络接入装置，其特征在于，所述封装模块包括生成单元和发送单元，其中，The network access device according to claim 11, wherein the encapsulation module comprises a generating unit and a sending unit, wherein
    所述生成单元，用于生成NAS请求消息，将所述接入信息携带在所述NAS请求消息中，其中，所述NAS请求消息是注册请求消息或者协议数据单元PDU会话建立请求消息；The generating unit is configured to generate a NAS request message, where the access information is carried in the NAS request message, where the NAS request message is a registration request message or a protocol data unit PDU session establishment request message;
    所述发送单元，用于发送初始化用户终端消息，将所述NAS请求消息携带在所述初始化用户终端消息中；The sending unit is configured to send an initial user terminal message, and the NAS request message is carried in the initial user terminal message;
    所述发送单元，还用于发送初始化用户终端消息，将所述接入信息中的固网接入点标识和会话标识中的至少一个携带在所述初始化用户终端消息中；The sending unit is further configured to: send an initial user terminal message, and carry at least one of a fixed network access point identifier and a session identifier in the access information in the initial user terminal message;
    所述生成单元，还用于生成NAS请求消息，将所述接入信息中的用户终端标识携带在所述NAS请求消息中，并将所述NAS请求消息携带在所述初始化用户终端消息中。The generating unit is further configured to generate a NAS request message, carry the user terminal identifier in the access information in the NAS request message, and carry the NAS request message in the initialized user terminal message.
  13. 如权利要求12所述的网络接入装置，其特征在于，The network access device of claim 12, wherein
    所述生成单元，还用于生成所述EAP消息，将所述接入信息携带在所述EAP消息中；并生成注册请求消息，将所述EAP消息携带在所述注册请求消息中；The generating unit is further configured to: generate the EAP message, and carry the access information in the EAP message; and generate a registration request message, where the EAP message is carried in the registration request message;
    所述发送单元，还用于发送初始化用户终端消息，将所述注册请求携带在所述初始化用户终端消息中。The sending unit is further configured to send an initial user terminal message, where the registration request is carried in the initial user terminal message.
  14. 一种网络设备，其特征在于，包括处理器和通信接口，其中，A network device, comprising: a processor and a communication interface, wherein
    所述通信接口，用于接收用户终端发送的点到点连接协议PPPoE消息或动态主机配置协议IPoE消息；The communication interface is configured to receive a point-to-point connection protocol PPPoE message or a dynamic host configuration protocol IPoE message sent by the user terminal;
    所述处理器，用于获取所述PPPoE消息或所述IPoE消息包含的所述用户终端的接入信息；将所述接入信息封装成非接入层NAS消息或可扩展身份验证协议EAP消息；The processor is configured to acquire access information of the user terminal included in the PPPoE message or the IPoE message, and encapsulate the access information into a non-access stratum NAS message or an extensible identity verification protocol EAP message ;
    所述通信接口，还用于向所述用户终端发送网络接口信息，使得所述用户终端接入网络。The communication interface is further configured to send network interface information to the user terminal, so that the user terminal accesses the network.
  15. 如权利要求14所述的网络设备，其特征在于，所述处理器将所述接入信息封装成NAS消息，执行为：The network device according to claim 14, wherein the processor encapsulates the access information into a NAS message, and the execution is:
    所述处理器生成NAS请求消息，将所述接入信息携带在所述NAS请求消息中；生成初始化用户终端消息，将所述NAS请求消息携带在所述初始化用户终端消息中；The processor generates a NAS request message, carries the access information in the NAS request message, generates an initial user terminal message, and carries the NAS request message in the initialized user terminal message;
    或者，or,
    所述处理器生成初始化用户终端消息，将所述接入信息中的固网接入点标识和会话标识中的至少一个携带在所述初始化用户终端消息中；所述处理器还用于并生成NAS请求消 息，将所述接入信息中的用户终端标识携带在所述NAS请求消息中，并将所述NAS请求消息携带在所述初始化用户终端消息中；The processor generates an initial user terminal message, and carries at least one of a fixed network access point identifier and a session identifier in the access information in the initial user terminal message; the processor is further configured to generate The NAS request message carries the user terminal identifier in the access information in the NAS request message, and carries the NAS request message in the initial user terminal message;
    其中，所述NAS请求消息是注册请求消息或者协议数据单元PDU会话建立请求消息。The NAS request message is a registration request message or a protocol data unit PDU session establishment request message.
  16. 如权利要求14所述的网络设备，其特征在于，所述处理器将所述接入信息封装成EAP消息，执行为：The network device according to claim 14, wherein the processor encapsulates the access information into an EAP message, and the execution is:
    所述处理器生成所述EAP消息，将所述接入信息携带在所述EAP消息中；然后，生成注册请求消息，将所述EAP消息携带在所述注册请求消息中；然后，生成初始化用户终端消息，将所述注册请求携带在所述初始化用户终端消息中。The processor generates the EAP message, and carries the access information in the EAP message; then, generates a registration request message, and carries the EAP message in the registration request message; and then generates an initialization user. The terminal message carries the registration request in the initial user terminal message.
  17. 如权利要求14所述的网络设备，其特征在于，所述处理器将所述接入信息封装成非接入层NAS消息或可扩展身份验证协议EAP消息之后，The network device according to claim 14, wherein the processor encapsulates the access information into a non-access stratum NAS message or an extensible authentication protocol EAP message,
    还用于根据所述接入信息中的用户终端标识，和固网接入点标识中的至少一个执行鉴权，并得到鉴权结果；当所述鉴权结果是鉴权通过时，为所述用户终端配置所述网络接口信息。The method is further configured to perform authentication according to at least one of a user terminal identifier in the access information and a fixed network access point identifier, and obtain an authentication result; when the authentication result is an authentication pass, The user terminal configures the network interface information.
  18. 如权利要求17所述的网络设备，其特征在于，根据所述接入信息中的固网接入点标识执行鉴权，具体执行为：The network device according to claim 17, wherein the performing authentication is performed according to the identifier of the fixed network access point in the access information, and the specific execution is:
    所述处理器根据所述固网接入点标识查找鉴权向量，并根据所述鉴权向量生成challenge值；The processor searches for an authentication vector according to the fixed network access point identifier, and generates a challenge value according to the authentication vector;
    所述通信接口将所述challenge值发送到所述用户终端，并接收所述用户终端发送的用户名和密码；Transmitting, by the communication interface, the challenge value to the user terminal, and receiving a username and a password sent by the user terminal;
    所述处理器根据所述用户名、所述密码和所述challenge值执行鉴权，并得到鉴权结果。The processor performs authentication according to the username, the password, and the challenge value, and obtains an authentication result.
  19. 如权利要求17所述的网络设备，其特征在于，所述处理器为所述用户终端配置所述网络接口信息，执行为：The network device according to claim 17, wherein the processor configures the network interface information for the user terminal, and the execution is:
    通过会话管理功能实体SMF为所述用户终端分配互联网协议地址IP地址和主机配置协议DHCP服务器地址中的至少一个；并通过移动功能实体AMF生成NAS回复消息，将所述IP地址和所述DHCP服务器中的至少一个携带在NAS回复消息中，得到所述网络接口信息。Assigning, by the session management function entity SMF, at least one of an internet protocol address IP address and a host configuration protocol DHCP server address to the user terminal; and generating a NAS reply message by using the mobile function entity AMF, the IP address and the DHCP server At least one of the packets is carried in the NAS reply message to obtain the network interface information.
  20. 如权利要求14所述的网络设备，其特征在于，所述通信接口向所述用户终端发送网络接口信息，具体执行为：The network device according to claim 14, wherein the communication interface sends network interface information to the user terminal, and the specific execution is:
    所述通信接口通过IP配置消息或网络控制协议NCP消息将所述IP地址和所述DHCP服务器地址中的至少一个发送到所述用户终端。The communication interface transmits at least one of the IP address and the DHCP server address to the user terminal via an IP configuration message or a Network Control Protocol NCP message.
PCT/CN2018/083565 2017-04-18 2018-04-18 Network access method and apparatus, and network device WO2018192528A1 (en)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP18788148.7A EP3582528B1 (en) 2017-04-18 2018-04-18 Network access method, system, access gateway and computer-readable storage medium
JP2020504757A JP6976411B2 (en) 2017-04-18 2018-04-18 Network access methods and devices as well as network devices
US16/566,690 US11395143B2 (en) 2017-04-18 2019-09-10 Network access method and apparatus and network device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710253160.0A CN108738013B (en) 2017-04-18 2017-04-18 Network access method, device and network equipment
CN201710253160.0 2017-04-18

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/566,690 Continuation US11395143B2 (en) 2017-04-18 2019-09-10 Network access method and apparatus and network device

Publications (1)

Publication Number Publication Date
WO2018192528A1 true WO2018192528A1 (en) 2018-10-25

Family

ID=63855607

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/083565 WO2018192528A1 (en) 2017-04-18 2018-04-18 Network access method and apparatus, and network device

Country Status (5)

Country Link
US (1) US11395143B2 (en)
EP (1) EP3582528B1 (en)
JP (1) JP6976411B2 (en)
CN (2) CN113923650A (en)
WO (1) WO2018192528A1 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021017849A1 (en) * 2019-07-31 2021-02-04 中兴通讯股份有限公司 Method for implementing 5g user registration, network element apparatus, and storage medium

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113923650A (en) * 2017-04-18 2022-01-11 华为技术有限公司 Network access method, device and communication system
CN109104448B (en) 2017-06-20 2021-10-01 华为技术有限公司 Session management method and device
CN109429363B (en) 2017-06-20 2021-04-20 华为技术有限公司 Session management method and device
US10778609B2 (en) * 2017-08-10 2020-09-15 Futurewei Technologies, Inc. Interactions between a broadband network gateway and a fifth generation core
US11943731B2 (en) 2018-09-14 2024-03-26 Telefonaktiebolaget Lm Ericsson (Publ) Registration of legacy fixed network residential gateway (FN-RG) to a 5G core network
EP3883290B1 (en) * 2018-11-21 2023-01-18 Guangdong Oppo Mobile Telecommunications Corp., Ltd. Data channel establishing methods and device
CN110535696A (en) * 2019-08-21 2019-12-03 新华三技术有限公司合肥分公司 Method for configuring network equipment, controller and the network equipment
US11032743B1 (en) * 2019-11-30 2021-06-08 Charter Communications Operating, Llc Methods and apparatus for supporting devices of different types using a residential gateway
US11233860B1 (en) 2020-11-20 2022-01-25 Grand Dunes Entry Systems, LLC Microcontroller device for secure communication
CN114338522B (en) * 2020-11-27 2024-04-05 成都市伏羲科技有限公司 IPv6 addressing and networking method based on identification management
CN116567626A (en) * 2022-01-27 2023-08-08 维沃移动通信有限公司 Equipment authentication method and device and communication equipment
CN114915612B (en) * 2022-04-22 2024-03-15 绿盟科技集团股份有限公司 Host access method, host to be accessed and DHCP server
CN115002933A (en) * 2022-06-28 2022-09-02 中国电信股份有限公司 Session establishment system, method, electronic device and storage medium

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102026194A (en) * 2009-09-14 2011-04-20 华为技术有限公司 Method, equipment and system for converging WiFi (Wireless Fidelity) network and WiMAX (Wireless Metropolitan Area Networking) network
CN102892170A (en) * 2012-09-19 2013-01-23 邦讯技术股份有限公司 Method and system for terminal to acquire core network internet protocol (IP) address
US20140059544A1 (en) * 2012-08-27 2014-02-27 Vmware, Inc. Framework for networking and security services in virtual networks
CN103687049A (en) * 2012-08-30 2014-03-26 中兴通讯股份有限公司 Multi-connection establishing method and system

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
BRPI0215728B1 (en) * 2002-05-01 2016-06-07 Ericsson Telefon Ab L M method to enable sim-based authentication, access controller, wireless terminal, and telecommunication system
CN1309233C (en) * 2004-07-20 2007-04-04 华为技术有限公司 Method for supporting PPPoA on wideband switch-in equipment
US7853708B2 (en) * 2006-02-24 2010-12-14 Cisco Technology, Inc. Techniques for replacing point to point protocol with dynamic host configuration protocol
CN101321054B (en) * 2007-06-08 2011-02-09 华为技术有限公司 Method and device for automatically preventing imitation of network side media access control address
CN103781073B (en) * 2012-10-26 2018-10-19 中兴通讯股份有限公司 The cut-in method and system of mobile subscriber's fixed network
JP5888749B2 (en) * 2013-02-08 2016-03-22 日本電信電話株式会社 Network connection authentication method and system
JP6146105B2 (en) * 2013-04-19 2017-06-14 日本電気株式会社 Gateway system, extended gateway, extended edge device, mobile terminal connection method and program
JP5931802B2 (en) * 2013-06-06 2016-06-08 日本電信電話株式会社 Terminal authentication method and system in network
CN113923650A (en) * 2017-04-18 2022-01-11 华为技术有限公司 Network access method, device and communication system

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102026194A (en) * 2009-09-14 2011-04-20 华为技术有限公司 Method, equipment and system for converging WiFi (Wireless Fidelity) network and WiMAX (Wireless Metropolitan Area Networking) network
US20140059544A1 (en) * 2012-08-27 2014-02-27 Vmware, Inc. Framework for networking and security services in virtual networks
CN103687049A (en) * 2012-08-30 2014-03-26 中兴通讯股份有限公司 Multi-connection establishing method and system
CN102892170A (en) * 2012-09-19 2013-01-23 邦讯技术股份有限公司 Method and system for terminal to acquire core network internet protocol (IP) address

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3582528A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021017849A1 (en) * 2019-07-31 2021-02-04 中兴通讯股份有限公司 Method for implementing 5g user registration, network element apparatus, and storage medium

Also Published As

Publication number Publication date
US11395143B2 (en) 2022-07-19
CN113923650A (en) 2022-01-11
US20200007543A1 (en) 2020-01-02
EP3582528B1 (en) 2022-07-13
JP6976411B2 (en) 2021-12-08
EP3582528A1 (en) 2019-12-18
EP3582528A4 (en) 2019-12-18
CN108738013B (en) 2021-11-19
CN108738013A (en) 2018-11-02
JP2020517207A (en) 2020-06-11

Similar Documents

Publication Publication Date Title
WO2018192528A1 (en) Network access method and apparatus, and network device
EP3657834B1 (en) Method, device and system for accessing network
US6308213B1 (en) Virtual dial-up protocol for network communication
US6073176A (en) Dynamic bidding protocol for conducting multilink sessions through different physical termination points
RU2556468C2 (en) Terminal access authentication method and customer premise equipment
EP1987629B1 (en) Techniques for authenticating a subscriber for an access network using dhcp
US6754712B1 (en) Virtual dial-up protocol for network communication
JP6884818B2 (en) VXLAN implementation methods, network devices, and communication systems
US8484715B2 (en) Method and system for network access and network connection device
CN101127600A (en) A method for user access authentication
US8336082B2 (en) Method for realizing the synchronous authentication among the different authentication control devices
US9749320B2 (en) Method and system for wireless local area network user to access fixed broadband network
BRPI0215728B1 (en) method to enable sim-based authentication, access controller, wireless terminal, and telecommunication system
WO2014117525A1 (en) Method and device for handling authentication of static user terminal
WO2018191854A1 (en) Method for accessing fixed network and access gateway network element
JP2002314549A (en) User authentication system and user authentication method used for the same
CN108738019B (en) User authentication method and device in converged network
EP2615788A1 (en) Method for dual stack user management and broadband access server
JP2007221533A (en) Ppp gateway device
WO2014101449A1 (en) Method for controlling access point in wireless local area network, and communication system
CN107733764B (en) Method, system and related equipment for establishing virtual extensible local area network tunnel
US20200275275A1 (en) Authentication method and apparatus
WO2010000157A1 (en) Configuration method, device and system for access device
CN107046568B (en) Authentication method and device
US8621198B2 (en) Simplified protocol for carrying authentication for network access

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18788148

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2018788148

Country of ref document: EP

Effective date: 20190912

ENP Entry into the national phase

Ref document number: 2020504757

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE